@mitre/hdf-schema 3.4.4 → 3.5.0

package/dist/schemas/hdf-comparison.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-comparison/v3.4.0",
+  "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-comparison/v3.5.0",
   "type": "object",
   "unevaluatedProperties": false,
   "required": [
@@ -11,13 +11,20 @@
     "requirementDiffs"
   ],
   "properties": {
+    "externalReferences": {
+      "type": "array",
+      "items": {
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
+      },
+      "description": "Optional references to external artifacts relevant to this comparison (CTI/STIX, advisories, or any URI-addressable artifact). Inert context; see External_Reference."
+    },
     "formatVersion": {
       "type": "string",
       "const": "1.0.0",
       "description": "Schema version for this comparison format."
     },
     "comparisonMode": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Comparison_Mode",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Comparison_Mode",
       "description": "The mode of comparison being performed."
     },
     "timestamp": {
@@ -26,50 +33,50 @@
       "description": "When this comparison was performed."
     },
     "generator": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0#/$defs/Generator",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Generator",
       "description": "Information about the tool that generated this comparison."
     },
     "sources": {
       "type": "array",
       "minItems": 2,
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Source"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Source"
       },
       "description": "The source documents being compared. At least two sources are required."
     },
     "matching": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Matching_Config",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Matching_Config",
       "description": "Configuration for how requirements were matched across sources."
     },
     "summary": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Comparison_Summary",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Comparison_Summary",
       "description": "Summary statistics for the overall comparison."
     },
     "baselineDiffs": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Baseline_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Baseline_Diff"
       },
       "description": "Comparison of baselines between sources."
     },
     "requirementDiffs": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Requirement_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Requirement_Diff"
       },
       "description": "Detailed comparison of individual requirements between sources."
     },
     "componentDiffs": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Component_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Component_Diff"
       },
       "description": "Comparison of components between two system documents. Used in systemDrift mode. A component's BOM changes surface as a field change on its boms[] here."
     },
     "packageDiffs": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Package_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Package_Diff"
       },
       "description": "RESERVED — not emitted by the current systemDrift comparison. systemDrift now reports a component's BOM changes as a field change on its boms[] (see componentDiffs), and standalone SBOM package diffing is a separate `hdf diff <sbom> <sbom>` output shape. This field is retained for a future normalized package-level diff; consumers must not expect it from today's systemDrift output."
     },
@@ -81,19 +88,19 @@
     "drift": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Requirement_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Requirement_Diff"
       },
       "description": "External/metadata changes separate from status changes (Terraform pattern)."
     },
     "annotations": {
       "type": "object",
       "additionalProperties": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0#/$defs/Annotation"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Annotation"
       },
       "description": "Map of annotation IDs to annotation objects, providing context or action items for requirement diffs."
     },
     "integrity": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0#/$defs/Integrity",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity",
       "description": "Cryptographic integrity information for verifying this comparison document."
     },
     "extensions": {
@@ -105,1801 +112,1945 @@
   "description": "Structured comparison between two or more HDF security assessment documents. Supports temporal, baseline, fleet, and multi-source comparison modes.",
   "title": "HDF Comparison",
   "$defs": {
-    "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.4.0",
-      "title": "HDF Comparison Primitives",
-      "description": "Types for representing structured comparisons between HDF security assessment documents.",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0",
+      "title": "HDF Common Primitives",
+      "description": "Shared building blocks used by hdf-results and hdf-baseline schemas.",
       "$defs": {
-        "Requirement_State": {
-          "type": "string",
-          "enum": [
-            "new",
-            "absent",
-            "unchanged",
-            "updated",
-            "fixed",
-            "regressed",
-            "moved",
-            "split",
-            "merged"
-          ],
-          "description": "SARIF-compatible vocabulary extended for security. 'new' = present only in new source, 'absent' = present only in old, 'unchanged' = same effective status, 'updated' = status changed (generic), 'fixed' = was failing now passing, 'regressed' = was passing now failing, 'moved' = reorganized same content, 'split'/'merged' = reserved for v1.1.",
-          "title": "Requirement State"
-        },
-        "Change_Reason": {
-          "type": "string",
-          "enum": [
-            "resultChanged",
-            "overrideAdded",
-            "overrideExpired",
-            "overrideRemoved",
-            "overrideModified",
-            "impactChanged",
-            "baselineUpgraded",
-            "controlMapped",
-            "scannerChanged",
-            "targetChanged",
-            "configChanged",
-            "metadataChanged"
-          ],
-          "description": "The reason a requirement's state changed between sources.",
-          "title": "Change Reason"
-        },
-        "Comparison_Mode": {
-          "type": "string",
-          "enum": [
-            "temporal",
-            "baseline",
-            "fleet",
-            "multiSource",
-            "baselineEvolution",
-            "systemDrift"
-          ],
-          "description": "The mode of comparison. 'temporal' compares the same target over time. 'baseline' compares against a golden reference. 'fleet' compares across multiple systems. 'multiSource' compares outputs from different scanners. 'baselineEvolution' compares two baseline documents to detect requirement changes between versions. 'systemDrift' compares two system documents to detect component-level changes.",
-          "title": "Comparison Mode"
-        },
-        "Source_Role": {
-          "type": "string",
-          "enum": [
-            "old",
-            "new",
-            "golden",
-            "reference",
-            "system"
-          ],
-          "description": "The role of a source document in the comparison.",
-          "title": "Source Role"
-        },
-        "Original_Format": {
-          "type": "string",
-          "enum": [
-            "hdf-v2",
-            "inspec-v1",
-            "sarif",
-            "oscal-ar",
-            "xccdf"
-          ],
-          "description": "The original format of the source document before conversion to HDF.",
-          "title": "Original Format"
-        },
-        "Match_Strategy": {
-          "type": "string",
-          "enum": [
-            "exactId",
-            "mappedId",
-            "cciMatch",
-            "nistMatch",
-            "fuzzyTitle",
-            "fuzzyContent"
+        "External_Reference": {
+          "type": "object",
+          "title": "External Reference",
+          "description": "A generalized reference to any external artifact by identity and/or location, modeled on the STIX 2.1 `external_references` common property. Purpose-agnostic: cite a CVE, an ATT&CK technique, a STIX bundle/object, a BOM, a runbook, or any vendor artifact — including kinds with no dedicated HDF reference category. `sourceName` names the system; `externalId` cites by id within that system; `href` locates it. `sourceName` + `externalId` is equivalently a URN (`urn:<sourceName>:<externalId>`, RFC 8141), so the by-identity and by-location forms stay interconvertible. A reference is inert context: it overrides nothing, so it carries only lightweight optional `addedBy`/`addedAt` attribution, never override machinery.",
+          "required": [
+            "sourceName"
           ],
-          "description": "The strategy used to match requirements across sources. 'exactId' matches by identical IDs. 'mappedId' uses an ID mapping table. 'cciMatch'/'nistMatch' match by framework identifiers. 'fuzzyTitle'/'fuzzyContent' use text similarity.",
-          "title": "Match Strategy"
-        },
-        "Conflict_Resolution": {
-          "type": "string",
-          "enum": [
-            "mostSevere",
-            "mostRecent",
-            "manual",
-            "unresolved"
+          "anyOf": [
+            {
+              "required": [
+                "externalId"
+              ]
+            },
+            {
+              "required": [
+                "href"
+              ]
+            },
+            {
+              "required": [
+                "description"
+              ]
+            }
           ],
-          "description": "How a conflict between multiple scanner results was resolved.",
-          "title": "Conflict Resolution"
+          "properties": {
+            "sourceName": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Name of the external system/source being referenced (e.g., 'cve', 'mitre-att&ck', 'stix', 'taxii', or any vendor label). Open string — not a closed enum. Use the `x-` prefix convention for custom/experimental sources, mirroring `bomType`."
+            },
+            "externalId": {
+              "type": "string",
+              "description": "Identifier of the artifact within `sourceName` (e.g., 'CVE-2021-44228' for source 'cve', 'T1059' for 'mitre-att&ck'). Cite by id without needing a URL. Together with `sourceName` this is a URN."
+            },
+            "href": {
+              "type": "string",
+              "format": "uri-reference",
+              "description": "Location of the artifact. `uri-reference` (not `uri`) so a bare internal `#fragment`/`#uuid` reference is expressible alongside absolute URLs. `checksum`/`mediaType` apply only to a retrievable `href`."
+            },
+            "description": {
+              "type": "string",
+              "description": "Human-readable description of what is referenced. Satisfies the at-least-one rule on its own when neither id nor href is available."
+            },
+            "rel": {
+              "type": "string",
+              "description": "Open relationship token describing how this reference relates to the referencing object. Deliberately open (cf. OSCAL `rel` allow-other, RFC 8288 extension relations). Documented starter vocabulary: 'reference' (generic), 'definition' (defines the concept), 'evidence' (supporting evidence), 'investigate' (a live pivot to investigate), 'canonical' (the authoritative source)."
+            },
+            "mediaType": {
+              "type": "string",
+              "description": "IANA media type of the referenced artifact when retrievable (RFC 6838), e.g., 'application/json'. Meaningful only with `href`."
+            },
+            "checksum": {
+              "$ref": "#/$defs/Checksum",
+              "description": "Integrity hash of the referenced artifact. Reuses the HDF `Checksum` primitive (not STIX `hashes`). Meaningful only with a retrievable `href`."
+            },
+            "addedBy": {
+              "$ref": "#/$defs/Identity",
+              "description": "Who attached this reference. Lightweight, flat attribution — a reference overrides nothing, so it has no chaining/superseding/disposition."
+            },
+            "addedAt": {
+              "type": "string",
+              "format": "date-time",
+              "description": "When this reference was attached (RFC 3339 / trimmed-UTC per HDF timestamp convention)."
+            },
+            "kind": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Open token classifying the referenced/embedded payload, turning a bare reference into an enrichment envelope. Deliberately open (like `sourceName`/`rel`), not a closed enum. Documented starter vocabulary: 'threat-intel' (STIX/CTI object), 'annotation' (human triage note), 'exploitation' (EPSS/KEV signal carried as context), 'advisory' (vendor/security advisory). Use the `x-` prefix for custom kinds."
+            },
+            "document": {
+              "type": "object",
+              "additionalProperties": true,
+              "description": "Optional lossless embedded copy of the referenced artifact — the raw STIX object, EPSS record, advisory, or annotation payload — preserved verbatim. Composes with `href`/`externalId` (which point at the artifact) and `checksum` (which ties the copy to the source): a single entry can both point and embed. HDF stays payload-agnostic — the content is carried untouched, never normalized into HDF fields — so this does not duplicate the source ontology (e.g. STIX rides here unchanged)."
+            }
+          },
+          "unevaluatedProperties": false,
+          "examples": [
+            {
+              "$comment": "By-identity: cite a CVE by its id in the 'cve' system without a URL — equivalently urn:cve:CVE-2021-44228.",
+              "sourceName": "cve",
+              "externalId": "CVE-2021-44228",
+              "rel": "definition"
+            },
+            {
+              "$comment": "By-identity AND by-locator together (anyOf, not oneOf) — an ATT&CK technique cited by id with its canonical URL.",
+              "sourceName": "mitre-att&ck",
+              "externalId": "T1059",
+              "href": "https://attack.mitre.org/techniques/T1059/",
+              "rel": "canonical"
+            },
+            {
+              "$comment": "By-locator to a retrievable STIX bundle, with integrity hash, media type, and attribution.",
+              "sourceName": "stix",
+              "href": "https://cti.example.org/bundles/log4shell.json",
+              "rel": "investigate",
+              "mediaType": "application/json",
+              "checksum": {
+                "algorithm": "sha256",
+                "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+              },
+              "addedBy": {
+                "type": "email",
+                "identifier": "analyst@agency.gov"
+              },
+              "addedAt": "2026-07-26T00:00:00Z"
+            },
+            {
+              "$comment": "Enrichment envelope: a STIX threat-intel object embedded losslessly in `document` and classified via `kind`, cited by id and pointed at by href — the pointer and the embedded copy compose. The payload rides verbatim; HDF does not normalize STIX fields.",
+              "sourceName": "stix",
+              "externalId": "vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001",
+              "href": "https://cti.example.org/bundles/log4shell.json#vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001",
+              "rel": "investigate",
+              "kind": "threat-intel",
+              "document": {
+                "type": "vulnerability",
+                "spec_version": "2.1",
+                "id": "vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001",
+                "name": "CVE-2021-44228",
+                "external_references": [
+                  {
+                    "source_name": "cve",
+                    "external_id": "CVE-2021-44228"
+                  }
+                ]
+              }
+            }
+          ]
         },
-        "Annotation_Category": {
+        "Hash_Algorithm": {
           "type": "string",
           "enum": [
-            "remediation",
-            "drift",
-            "waiver",
-            "baselineChange",
-            "scannerNote"
+            "sha256",
+            "sha384",
+            "sha512",
+            "blake3"
           ],
-          "description": "The category of an annotation attached to a comparison.",
-          "title": "Annotation Category"
+          "description": "Supported cryptographic hash algorithms for checksums and integrity verification. blake3 covers container-image and other artifact digests that use it.",
+          "title": "Hash Algorithm"
         },
-        "Field_Change": {
+        "Requirement_Group": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "op",
-            "path"
+            "id",
+            "requirements"
           ],
           "properties": {
-            "op": {
+            "id": {
               "type": "string",
-              "title": "Op",
-              "enum": [
-                "add",
-                "remove",
-                "replace"
-              ],
-              "description": "The type of change operation."
+              "description": "The unique identifier for the group. Example: the relative path to the file specifying the requirements."
             },
-            "path": {
+            "title": {
               "type": "string",
-              "description": "JSON Pointer path to the changed field."
-            },
-            "oldValue": {
-              "description": "The previous value of the field (for 'remove' and 'replace' operations)."
+              "description": "The title of the group - should be human readable."
             },
-            "newValue": {
-              "description": "The new value of the field (for 'add' and 'replace' operations)."
+            "requirements": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "The set of requirements as specified by their ids in this group. Example: 'SV-238196'."
             }
           },
-          "description": "A single field-level change between two versions of a requirement.",
-          "title": "Field Change"
+          "description": "Describes a group of requirements, such as those defined in a single file.",
+          "title": "Requirement Group"
         },
-        "Source": {
+        "Dependency": {
           "type": "object",
           "unevaluatedProperties": false,
-          "required": [
-            "role",
-            "label"
-          ],
+          "required": [],
           "properties": {
-            "role": {
-              "$ref": "#/$defs/Source_Role",
-              "description": "The role of this source in the comparison."
+            "name": {
+              "type": "string",
+              "description": "The name or assigned alias."
             },
-            "label": {
+            "url": {
               "type": "string",
-              "description": "Human-readable label for this source. Example: 'Before remediation scan'."
+              "format": "uri-reference",
+              "description": "The address of the dependency."
             },
-            "uri": {
+            "branch": {
               "type": "string",
-              "format": "uri",
-              "description": "URI pointing to the source document."
+              "description": "The branch name for a git repo."
             },
-            "originalFormat": {
-              "$ref": "#/$defs/Original_Format",
-              "description": "The original format of the source document before conversion to HDF."
+            "path": {
+              "type": "string",
+              "description": "The relative path if the dependency is locally available."
             },
-            "checksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Checksum",
-              "description": "Cryptographic checksum of the source document for integrity verification."
+            "statusMessage": {
+              "type": "string",
+              "description": "The reason for the status if it is 'failed' or 'skipped'."
             },
-            "assessmentTimestamp": {
+            "status": {
               "type": "string",
-              "format": "date-time",
-              "description": "When the source assessment was performed. ISO 8601 format."
+              "description": "The status. Should be: 'loaded', 'failed', or 'skipped'."
             },
-            "tool": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0#/$defs/Tool",
-              "description": "The security tool that produced the assessment data in this source."
+            "git": {
+              "type": "string",
+              "format": "uri",
+              "description": "The location of the git repo. Example: 'https://github.com/my-org/ubuntu-22.04-stig-baseline.git'."
             },
-            "components": {
-              "type": "array",
-              "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.4.0#/$defs/Component"
+            "supermarket": {
+              "type": "string",
+              "description": "The 'user/profilename' attribute for a Supermarket server."
+            },
+            "compliance": {
+              "type": "string",
+              "description": "The 'user/profilename' attribute for an Automate server."
+            }
+          },
+          "examples": [
+            {
+              "name": "ubuntu-22.04-baseline",
+              "url": "https://github.com/my-org/ubuntu-22.04-stig-baseline",
+              "git": "https://github.com/my-org/ubuntu-22.04-stig-baseline.git",
+              "branch": "main",
+              "status": "loaded"
+            },
+            {
+              "name": "ssl-tls-baseline",
+              "path": "../shared-baselines/ssl-tls",
+              "status": "loaded"
+            },
+            {
+              "name": "windows-2022-baseline",
+              "git": "https://github.com/security-org/windows-2022-stig.git",
+              "branch": "v1.2.0",
+              "status": "failed",
+              "statusMessage": "Unable to clone repository: authentication failed"
+            },
+            {
+              "name": "chef-supermarket-baseline",
+              "supermarket": "dev-sec/linux-baseline",
+              "status": "loaded"
+            }
+          ],
+          "description": "A dependency for a baseline. Can include relative paths or URLs for where to find the dependency.",
+          "title": "Dependency"
+        },
+        "Reference": {
+          "anyOf": [
+            {
+              "type": "object",
+              "required": [
+                "ref"
+              ],
+              "properties": {
+                "ref": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "description": "A human readable/meaningful reference. Example: a book title."
+                    },
+                    {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "additionalProperties": true
+                      },
+                      "description": "An array of reference objects."
+                    }
+                  ]
+                }
               },
-              "description": "The components assessed in this source."
+              "description": "A reference using the 'ref' field."
             },
-            "baselineRef": {
+            {
               "type": "object",
-              "unevaluatedProperties": false,
               "required": [
-                "name"
+                "url"
               ],
               "properties": {
-                "name": {
+                "url": {
                   "type": "string",
-                  "description": "Name of the baseline used in this source."
-                },
-                "version": {
+                  "format": "uri"
+                }
+              },
+              "description": "A URL pointing at the reference."
+            },
+            {
+              "type": "object",
+              "required": [
+                "uri"
+              ],
+              "properties": {
+                "uri": {
                   "type": "string",
-                  "description": "Version of the baseline used in this source."
+                  "format": "uri"
                 }
               },
-              "description": "Reference to the baseline used in this source assessment."
+              "description": "A URI pointing at the reference."
             }
-          },
-          "description": "A source document participating in the comparison.",
-          "title": "Source"
+          ],
+          "description": "A reference to an external document.",
+          "title": "Reference"
         },
-        "Matching_Config": {
+        "Source_Location": {
           "type": "object",
           "unevaluatedProperties": false,
-          "required": [
-            "primaryStrategy"
-          ],
+          "required": [],
           "properties": {
-            "primaryStrategy": {
-              "$ref": "#/$defs/Match_Strategy",
-              "description": "The primary strategy used to match requirements across sources."
-            },
-            "fallbackStrategies": {
-              "type": "array",
-              "items": {
-                "$ref": "#/$defs/Match_Strategy"
-              },
-              "description": "Ordered list of fallback strategies tried when the primary strategy fails to find a match."
-            },
-            "minimumConfidence": {
-              "type": "number",
-              "minimum": 0,
-              "maximum": 1,
-              "description": "Minimum confidence score (0-1) required to accept a match."
-            },
-            "mappingTableUri": {
+            "ref": {
               "type": "string",
-              "format": "uri",
-              "description": "URI pointing to an external mapping table used for ID translation."
+              "description": "Path to the file that this requirement originates from."
             },
-            "fingerprintFields": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "description": "Fields used to compute a fingerprint for fuzzy matching."
+            "line": {
+              "type": "number",
+              "description": "The line on which this requirement is located."
             }
           },
-          "description": "Configuration for how requirements are matched across sources.",
-          "title": "Matching Config"
+          "examples": [
+            {
+              "ref": "controls/SV-260476.rb",
+              "line": 1
+            },
+            {
+              "ref": "profiles/ubuntu/controls/configure_audit.rb",
+              "line": 42
+            }
+          ],
+          "description": "The explicit location of a requirement within source code.",
+          "title": "Source Location"
         },
-        "State_Counts": {
+        "Supported_Platform": {
           "type": "object",
           "unevaluatedProperties": false,
+          "required": [],
           "properties": {
-            "fixed": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements that changed from failing to passing."
-            },
-            "regressed": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements that changed from passing to failing."
-            },
-            "new": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements present only in the new source."
-            },
-            "absent": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements present only in the old source."
+            "platformFamily": {
+              "type": "string",
+              "description": "The platform family. Example: 'redhat'."
             },
-            "unchanged": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements with the same effective status."
+            "platformName": {
+              "type": "string",
+              "description": "The platform name - can include wildcards. Example: 'debian'."
             },
-            "updated": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements with a generic status change."
+            "platform": {
+              "type": "string",
+              "description": "The location of the platform. Can be: 'os', 'aws', 'azure', or 'gcp'."
             },
-            "moved": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements that were reorganized without content change."
+            "release": {
+              "type": "string",
+              "description": "The release of the platform. Example: '20.04' for 'ubuntu'."
             }
           },
-          "description": "Counts of requirements in each state.",
-          "title": "State Counts"
+          "description": "A supported platform target. Example: the platform name being 'ubuntu'.",
+          "title": "Supported Platform"
         },
-        "Severity_Breakdown": {
+        "Checksum": {
           "type": "object",
           "unevaluatedProperties": false,
+          "required": [
+            "algorithm",
+            "value"
+          ],
           "properties": {
-            "critical": {
-              "$ref": "#/$defs/State_Counts",
-              "description": "State counts for critical severity requirements."
-            },
-            "high": {
-              "$ref": "#/$defs/State_Counts",
-              "description": "State counts for high severity requirements."
-            },
-            "medium": {
-              "$ref": "#/$defs/State_Counts",
-              "description": "State counts for medium severity requirements."
+            "algorithm": {
+              "$ref": "#/$defs/Hash_Algorithm",
+              "description": "The hash algorithm used for the checksum."
             },
-            "low": {
-              "$ref": "#/$defs/State_Counts",
-              "description": "State counts for low severity requirements."
+            "value": {
+              "type": "string",
+              "description": "The checksum value."
             }
           },
-          "description": "Breakdown of state counts by severity level.",
-          "title": "Severity Breakdown"
+          "examples": [
+            {
+              "algorithm": "sha256",
+              "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+            },
+            {
+              "algorithm": "sha512",
+              "value": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e"
+            }
+          ],
+          "description": "Cryptographic checksum for baseline integrity verification.",
+          "title": "Checksum"
         },
-        "Per_Source_Summary": {
+        "Identity": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "sourceIndex",
-            "label"
+            "identifier",
+            "type"
           ],
           "properties": {
-            "sourceIndex": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Zero-based index into the sources array identifying which source this summary is for."
-            },
-            "label": {
+            "identifier": {
               "type": "string",
-              "description": "Human-readable label for this source."
-            },
-            "fixed": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements that changed from failing to passing."
-            },
-            "regressed": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements that changed from passing to failing."
+              "description": "The identifier value. Example: 'user@example.com', 'jdoe', 'automated-scanner-01'."
             },
-            "new": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements present only in the new source."
+            "type": {
+              "type": "string",
+              "title": "Identity Type",
+              "enum": [
+                "email",
+                "username",
+                "system",
+                "agent",
+                "simple",
+                "other"
+              ],
+              "description": "The type of identifier. Use 'email' for email addresses, 'username' for user accounts, 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent' for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF, 'simple' for basic string identifiers without additional classification, or 'other' for custom identity systems."
             },
-            "absent": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements present only in the old source."
+            "description": {
+              "type": "string",
+              "description": "Optional description of the identity or identity system, particularly useful when type is 'other'."
+            }
+          },
+          "examples": [
+            {
+              "type": "email",
+              "identifier": "admin@example.com"
             },
-            "unchanged": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements with the same effective status."
+            {
+              "type": "username",
+              "identifier": "jdoe",
+              "description": "Security Operations Analyst"
             },
-            "updated": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements with a generic status change."
+            {
+              "type": "system",
+              "identifier": "automated-scanner-01",
+              "description": "Nightly compliance scan pipeline"
             },
-            "moved": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements that were reorganized without content change."
+            {
+              "type": "agent",
+              "identifier": "cve-enrichment-bot/v0.4.2",
+              "description": "OpenAI GPT-4 via internal CVE-enrichment tool; proposes environmental CVSS for human review"
             }
-          },
-          "description": "Summary statistics for a single source in a multi-source comparison.",
-          "title": "Per Source Summary"
+          ],
+          "description": "Represents an identity that performed an action, such as capturing evidence or applying an override.",
+          "title": "Identity"
         },
-        "Comparison_Summary": {
+        "Evidence": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "total",
-            "matchedCount",
-            "unmatchedOldCount",
-            "unmatchedNewCount"
+            "type",
+            "data"
           ],
           "properties": {
-            "total": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Total number of unique requirements across all sources."
-            },
-            "matchedCount": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements successfully matched between sources."
-            },
-            "unmatchedOldCount": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements in the old source with no match in the new source."
-            },
-            "unmatchedNewCount": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements in the new source with no match in the old source."
-            },
-            "new": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements present only in the new source."
-            },
-            "absent": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements present only in the old source."
-            },
-            "unchanged": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements with the same effective status."
+            "type": {
+              "type": "string",
+              "title": "Evidence Type",
+              "enum": [
+                "screenshot",
+                "code",
+                "log",
+                "url",
+                "file",
+                "other"
+              ],
+              "description": "The type of evidence being provided."
             },
-            "updated": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements with a generic status change."
+            "data": {
+              "type": "string",
+              "description": "The evidence content. For screenshots/files: base64-encoded data or URL. For code/logs: the raw text. For URLs: the URL string."
             },
-            "fixed": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements that changed from failing to passing."
+            "description": {
+              "type": "string",
+              "description": "Human-readable description of what this evidence shows."
             },
-            "regressed": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements that changed from passing to failing."
+            "mimeType": {
+              "type": "string",
+              "description": "MIME type of the evidence. Example: 'image/png', 'text/plain', 'application/json'."
             },
-            "moved": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Number of requirements that were reorganized without content change."
+            "encoding": {
+              "type": "string",
+              "description": "Encoding used for the data. Example: 'base64', 'utf-8'."
             },
-            "oldCompliancePercent": {
+            "size": {
               "type": "number",
-              "description": "Compliance percentage of the old source (0-100)."
+              "description": "Size of the evidence data in bytes."
             },
-            "newCompliancePercent": {
-              "type": "number",
-              "description": "Compliance percentage of the new source (0-100)."
+            "capturedAt": {
+              "type": "string",
+              "format": "date-time",
+              "description": "Timestamp when this evidence was captured. ISO 8601 format."
             },
-            "complianceDelta": {
-              "type": "number",
-              "description": "Change in compliance percentage (new - old)."
+            "capturedBy": {
+              "$ref": "#/$defs/Identity",
+              "description": "Identity of who or what captured this evidence."
+            }
+          },
+          "examples": [
+            {
+              "type": "screenshot",
+              "data": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
+              "description": "Screenshot showing firewall configuration with required ports blocked",
+              "mimeType": "image/png",
+              "encoding": "base64",
+              "size": 95,
+              "capturedAt": "2025-12-14T10:30:00Z",
+              "capturedBy": {
+                "identifier": "security-auditor@example.com",
+                "type": "email"
+              }
             },
-            "averageMatchConfidence": {
-              "type": "number",
-              "minimum": 0,
-              "maximum": 1,
-              "description": "Average confidence score across all requirement matches (0-1)."
+            {
+              "type": "code",
+              "data": "# Nginx configuration\nserver {\n  listen 443 ssl;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_ciphers HIGH:!aNULL:!MD5;\n}",
+              "description": "Server configuration showing TLS 1.2+ enforcement",
+              "mimeType": "text/plain",
+              "capturedAt": "2025-12-14T10:45:00Z"
             },
-            "bySeverity": {
-              "$ref": "#/$defs/Severity_Breakdown",
-              "description": "State counts broken down by severity level."
+            {
+              "type": "log",
+              "data": "[2025-12-14 10:00:15] INFO: Security scan completed - 0 critical vulnerabilities found\n[2025-12-14 10:00:16] INFO: All required security patches applied\n[2025-12-14 10:00:17] INFO: System compliant with security baseline",
+              "description": "Security scan log output",
+              "mimeType": "text/plain",
+              "size": 256
             },
-            "perSource": {
-              "type": "array",
-              "items": {
-                "$ref": "#/$defs/Per_Source_Summary"
-              },
-              "description": "Summary statistics for each individual source in a multi-source comparison."
+            {
+              "type": "url",
+              "data": "https://jira.example.com/browse/SEC-12345",
+              "description": "Link to security ticket documenting remediation work",
+              "capturedAt": "2025-12-14T11:00:00Z"
+            },
+            {
+              "type": "file",
+              "data": "UEsDBBQAAAAIAI1ZX1YhQp8FHgAAABIAAAAIAAAAdGVzdC50eHRLy8nPS8lQSgIAUmNEBhQAAAA=",
+              "description": "Compliance audit report PDF",
+              "mimeType": "application/pdf",
+              "encoding": "base64",
+              "size": 2048,
+              "capturedAt": "2025-12-14T12:00:00Z",
+              "capturedBy": {
+                "identifier": "compliance-system",
+                "type": "system"
+              }
             }
-          },
-          "description": "Summary statistics for the overall comparison.",
-          "title": "Comparison Summary"
+          ],
+          "description": "Supporting evidence for a finding or override, such as screenshots, code samples, log excerpts, or URLs.",
+          "title": "Evidence"
         },
-        "Baseline_Diff": {
+        "Remediation": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "name",
-            "state"
+            "uri"
           ],
           "properties": {
-            "name": {
+            "uri": {
               "type": "string",
-              "description": "Name of the baseline being compared."
+              "format": "uri",
+              "description": "URI pointing to automated remediation resources (Ansible playbooks, Terraform scripts, etc.). Examples: GitHub repository, DISA STIG Supplemental Automation Content, vendor-provided scripts."
             },
-            "state": {
-              "type": "string",
-              "title": "Baseline Diff State",
-              "enum": [
-                "new",
-                "absent",
-                "unchanged",
-                "updated"
-              ],
-              "description": "The state of this baseline in the comparison."
+            "checksum": {
+              "$ref": "#/$defs/Checksum",
+              "description": "Optional cryptographic checksum for verifying the integrity of remediation resources fetched from the URI. Recommended for security when referencing external automation scripts."
+            }
+          },
+          "examples": [
+            {
+              "uri": "https://github.com/ansible-lockdown/RHEL9-STIG/tree/main/tasks"
             },
-            "oldVersion": {
+            {
+              "uri": "https://artifacts.example.com/remediation/ubuntu-22.04-hardening-v1.2.tar.gz",
+              "checksum": {
+                "algorithm": "sha256",
+                "value": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"
+              }
+            }
+          ],
+          "description": "Reference to automated remediation resources for implementing security controls. Points to external automation content like Ansible playbooks, Terraform scripts, or vendor-provided remediation tools.",
+          "title": "Remediation"
+        },
+        "Verification_Method": {
+          "type": "object",
+          "unevaluatedProperties": false,
+          "required": [
+            "type",
+            "controller"
+          ],
+          "properties": {
+            "type": {
               "type": "string",
-              "description": "Version of the baseline in the old source."
+              "description": "The type of verification method. Example: 'JsonWebKey2020', 'RsaVerificationKey2018', 'Ed25519VerificationKey2020'."
             },
-            "newVersion": {
+            "controller": {
               "type": "string",
-              "description": "Version of the baseline in the new source."
+              "description": "The entity that controls this verification method. Can be a DID, URI, or other identifier."
             },
-            "mappingSource": {
+            "publicKeyJwk": {
+              "type": "object",
+              "additionalProperties": true,
+              "description": "Public key in JSON Web Key format."
+            },
+            "publicKeyPem": {
               "type": "string",
-              "description": "The source of any ID mapping used to correlate requirements across baseline versions."
+              "description": "Public key in PEM format. Example: '-----BEGIN PUBLIC KEY-----...-----END PUBLIC KEY-----'."
+            },
+            "publicKeyBase58": {
+              "type": "string",
+              "description": "Public key in Base58 format, commonly used with Ed25519 keys."
             }
           },
-          "description": "Comparison of a baseline between sources.",
-          "title": "Baseline Diff"
+          "description": "Verification method containing the public key needed to verify a digital signature. Supports multiple key formats including JWK (for RSA, EC), PEM, and Base58.",
+          "title": "Verification Method"
         },
-        "Component_Diff": {
+        "Milestone": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "name",
-            "state"
+            "description",
+            "estimatedCompletion",
+            "status"
           ],
           "properties": {
-            "name": {
+            "description": {
               "type": "string",
-              "description": "Component name used for matching across system versions."
+              "description": "Description of this milestone or task."
             },
-            "state": {
+            "estimatedCompletion": {
               "type": "string",
-              "title": "Baseline Diff State",
-              "enum": [
-                "new",
-                "absent",
-                "unchanged",
-                "updated"
-              ],
-              "description": "The state of this component in the comparison."
+              "format": "date-time",
+              "description": "Estimated completion date. ISO 8601 format."
             },
-            "before": {
-              "oneOf": [
-                {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.4.0#/$defs/Component"
-                },
-                {
-                  "type": "null"
-                }
+            "status": {
+              "type": "string",
+              "title": "Milestone Status",
+              "enum": [
+                "pending",
+                "inProgress",
+                "completed"
               ],
-              "description": "Component snapshot from the old system document. Null when state is 'new'."
+              "description": "Current status of this milestone."
             },
-            "after": {
-              "oneOf": [
-                {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.4.0#/$defs/Component"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Component snapshot from the new system document. Null when state is 'absent'."
+            "completedAt": {
+              "type": "string",
+              "format": "date-time",
+              "description": "Actual completion timestamp. ISO 8601 format."
             },
-            "fieldChanges": {
-              "type": "array",
-              "items": {
-                "$ref": "#/$defs/Field_Change"
-              },
-              "description": "Detailed field-level changes between the before and after component snapshots."
+            "completedBy": {
+              "$ref": "#/$defs/Identity",
+              "description": "Identity of who completed this milestone."
             }
           },
-          "description": "Comparison of a single component between two system document versions.",
-          "title": "Component Diff"
+          "description": "A milestone or task within a POA&M remediation plan.",
+          "title": "Milestone"
         },
-        "Package_Diff": {
+        "Signature": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "state"
-          ],
-          "anyOf": [
-            {
-              "required": [
-                "purl"
-              ]
-            },
-            {
-              "required": [
-                "identifier"
-              ]
-            }
+            "type",
+            "created",
+            "creator",
+            "signatureValue",
+            "proofPurpose",
+            "verificationMethod"
           ],
           "properties": {
-            "purl": {
+            "type": {
               "type": "string",
-              "description": "Package URL (purl) — the preferred identity key for matching software packages across BOMs. Optional: BOM nodes without a purl (AI models, datasets, hardware parts, crypto algorithms) key on identifier instead."
+              "description": "The signature suite type. Example: 'JsonWebSignature2020', 'RsaSignature2018', 'Ed25519Signature2020'."
             },
-            "identifier": {
+            "created": {
               "type": "string",
-              "description": "Generic identity key for matching a BOM node across versions when no purl applies — e.g. a Hugging Face model ref, dataset uniqueId, crypto algorithm OID, or hardware part number. At least one of purl or identifier is required."
+              "format": "date-time",
+              "description": "When the signature was created. ISO 8601 format."
             },
-            "name": {
+            "creator": {
+              "$ref": "#/$defs/Identity",
+              "description": "The identity that created this signature."
+            },
+            "signatureValue": {
               "type": "string",
-              "description": "Human-readable node name."
+              "description": "The base64-encoded or base58-encoded signature value."
             },
-            "state": {
+            "proofPurpose": {
               "type": "string",
-              "title": "Package Diff State",
-              "enum": [
-                "added",
-                "removed",
-                "updated",
-                "unchanged"
-              ],
-              "description": "The state of this package: added (new in new SBOM), removed (absent from new SBOM), updated (version changed), unchanged."
+              "description": "The purpose of this signature. Example: 'attestation', 'authentication', 'assertionMethod'."
             },
-            "oldVersion": {
+            "verificationMethod": {
+              "$ref": "#/$defs/Verification_Method",
+              "description": "The verification method containing the public key for signature verification."
+            },
+            "nonce": {
               "type": "string",
-              "description": "Package version in the old SBOM."
+              "description": "Random value to prevent replay attacks."
             },
-            "newVersion": {
+            "challenge": {
               "type": "string",
-              "description": "Package version in the new SBOM."
+              "description": "Challenge value from the verifier, used in challenge-response authentication."
             },
-            "licenses": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "description": "License identifiers for this package."
+            "domain": {
+              "type": "string",
+              "description": "Domain restriction for the signature, prevents cross-domain replay attacks."
             }
           },
           "examples": [
             {
-              "$comment": "Software package diff keyed by purl (the SBOM case).",
-              "purl": "pkg:npm/express@4.18.2",
-              "name": "express",
-              "state": "updated",
-              "oldVersion": "4.18.1",
-              "newVersion": "4.18.2"
+              "type": "JsonWebSignature2020",
+              "created": "2025-12-14T10:00:00Z",
+              "creator": {
+                "identifier": "security-team@example.com",
+                "type": "email"
+              },
+              "signatureValue": "eyJhbGciOiJSUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..MEYCIQDvKbtLRhWAa",
+              "proofPurpose": "attestation",
+              "verificationMethod": {
+                "type": "JsonWebKey2020",
+                "controller": "did:example:123456789abcdefghi",
+                "publicKeyJwk": {
+                  "kty": "RSA",
+                  "n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtV",
+                  "e": "AQAB"
+                }
+              }
             },
             {
-              "$comment": "AI-model node diff keyed by identifier when no purl applies.",
-              "identifier": "acme/llama-2-7b-chat-support",
-              "name": "Llama-2-7b-chat (finetuned)",
-              "state": "added",
-              "newVersion": "1.2.0"
+              "type": "RsaSignature2018",
+              "created": "2025-12-14T11:30:00Z",
+              "creator": {
+                "identifier": "ciso@example.com",
+                "type": "email"
+              },
+              "signatureValue": "pY9...Cg==",
+              "proofPurpose": "authentication",
+              "verificationMethod": {
+                "type": "RsaVerificationKey2018",
+                "controller": "https://example.com/issuers/565049",
+                "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAryQICCl6NZ5gDKrnSztO\n-----END PUBLIC KEY-----"
+              },
+              "nonce": "c0ae1c8e-c7e7-469f-b252-86e6a0e7387e"
+            },
+            {
+              "type": "Ed25519Signature2020",
+              "created": "2025-12-14T14:00:00Z",
+              "creator": {
+                "identifier": "automated-signer",
+                "type": "system",
+                "description": "Hardware security module (HSM) for automated attestations"
+              },
+              "signatureValue": "z58DAdFfa9SkqZMVMxABEBC59Ck6WibLZ",
+              "proofPurpose": "assertionMethod",
+              "verificationMethod": {
+                "type": "Ed25519VerificationKey2020",
+                "controller": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+                "publicKeyBase58": "H3C2AVvLMv6gmMNam3uVAjZpfkcJCwDwnZn6z3wXmqPV"
+              },
+              "challenge": "1f44d2f3-d16c-47a4-9f5f-1d6e8f4e3a2b",
+              "domain": "https://compliance.example.com"
             }
           ],
-          "description": "Comparison of a single BOM node between two BOM versions, matched by purl (software) or identifier (models, datasets, hardware, crypto).",
-          "title": "Package Diff"
+          "description": "A digital signature following W3C Data Integrity Proofs pattern. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other cryptographic signing methods via JWK, PEM, or Base58 key formats.",
+          "title": "Signature"
         },
-        "Scanner_Conflict": {
+        "Baseline_Metadata": {
           "type": "object",
-          "unevaluatedProperties": false,
-          "required": [
-            "field",
-            "values"
-          ],
           "properties": {
-            "field": {
-              "type": "string",
-              "description": "The field where the conflict occurs."
-            },
-            "values": {
+            "externalReferences": {
               "type": "array",
               "items": {
-                "type": "object",
-                "unevaluatedProperties": false,
-                "required": [
-                  "sourceIndex",
-                  "sourceLabel",
-                  "value"
-                ],
-                "properties": {
-                  "sourceIndex": {
-                    "type": "integer",
-                    "minimum": 0,
-                    "description": "Zero-based index into the sources array."
-                  },
-                  "sourceLabel": {
-                    "type": "string",
-                    "description": "Human-readable label for the source."
-                  },
-                  "value": {
-                    "description": "The value reported by this source for the conflicting field."
-                  }
-                }
+                "$ref": "#/$defs/External_Reference"
               },
-              "description": "The conflicting values from each source."
+              "description": "Optional references to external artifacts relevant to this baseline (CTI/STIX, advisories, source catalogs, or any URI-addressable artifact). Travels with the baseline definition. Inert context; see External_Reference."
             },
-            "resolvedIndex": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Index of the source whose value was chosen as the resolution."
+            "name": {
+              "type": "string",
+              "description": "The name - must be unique."
             },
-            "resolution": {
-              "$ref": "#/$defs/Conflict_Resolution",
-              "description": "How the conflict was resolved."
-            }
-          },
-          "description": "A conflict between scanner results for the same requirement.",
-          "title": "Scanner Conflict"
-        },
-        "Annotation": {
-          "type": "object",
-          "unevaluatedProperties": false,
-          "required": [
-            "label"
-          ],
-          "properties": {
-            "label": {
+            "title": {
               "type": "string",
-              "description": "Human-readable label for this annotation."
+              "description": "The title - should be human readable."
             },
-            "description": {
+            "maintainer": {
               "type": "string",
-              "description": "Detailed description of the annotation."
+              "description": "The maintainer(s)."
             },
-            "category": {
-              "$ref": "#/$defs/Annotation_Category",
-              "description": "The category of this annotation."
+            "copyright": {
+              "type": "string",
+              "description": "The copyright holder(s)."
             },
-            "needsConfirmation": {
-              "type": "boolean",
-              "description": "Whether this annotation requires human confirmation before acting on it."
-            }
-          },
-          "description": "An annotation attached to a comparison, providing context or action items.",
-          "title": "Annotation"
-        },
-        "Requirement_Diff": {
-          "type": "object",
-          "unevaluatedProperties": false,
-          "required": [
-            "id",
-            "state",
-            "changeReasons",
-            "before",
-            "after",
-            "fieldChanges"
-          ],
-          "properties": {
-            "id": {
+            "copyrightEmail": {
               "type": "string",
-              "description": "The canonical requirement identifier used for this diff."
+              "description": "The email address or other contact information of the copyright holder(s)."
             },
-            "state": {
-              "$ref": "#/$defs/Requirement_State",
-              "description": "The state of this requirement in the comparison."
+            "license": {
+              "type": "string",
+              "description": "The copyright license. Example: 'Apache-2.0'."
             },
-            "changeReasons": {
+            "summary": {
+              "type": "string",
+              "description": "The summary. Example: the Security Technical Implementation Guide (STIG) header."
+            },
+            "version": {
+              "type": "string",
+              "description": "The version of the baseline."
+            },
+            "supports": {
               "type": "array",
               "items": {
-                "$ref": "#/$defs/Change_Reason"
+                "$ref": "#/$defs/Supported_Platform"
               },
-              "description": "The reasons for the state change."
+              "description": "The set of supported platform targets."
             },
-            "before": {
-              "oneOf": [
-                {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.4.0#/$defs/Evaluated_Requirement"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "The requirement as it appeared in the old/reference source. Null when state is 'new'."
+            "status": {
+              "type": "string",
+              "description": "The status. Example: 'loaded'."
             },
-            "after": {
-              "oneOf": [
-                {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.4.0#/$defs/Evaluated_Requirement"
-                },
+            "labels": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Optional key-value labels for flexible grouping. Well-known keys: system, component, environment, region, team. Values must be strings."
+            }
+          },
+          "examples": [
+            {
+              "name": "rhel-9-stig-baseline",
+              "title": "Red Hat Enterprise Linux 9 STIG Baseline",
+              "maintainer": "MITRE SAF Team",
+              "copyright": "The MITRE Corporation",
+              "copyrightEmail": "saf@mitre.org",
+              "license": "Apache-2.0",
+              "summary": "InSpec baseline for RHEL 9 STIG compliance",
+              "version": "1.0.0",
+              "supports": [
                 {
-                  "type": "null"
+                  "platformName": "redhat",
+                  "platformFamily": "redhat",
+                  "release": "9"
                 }
               ],
-              "description": "The requirement as it appeared in the new source. Null when state is 'absent'."
-            },
-            "fieldChanges": {
+              "status": "loaded"
+            }
+          ],
+          "description": "Shared metadata fields for baselines. Used in both standalone baseline documents and evaluated baseline results.",
+          "title": "Baseline Metadata"
+        },
+        "Requirement_Core": {
+          "type": "object",
+          "properties": {
+            "externalReferences": {
               "type": "array",
               "items": {
-                "$ref": "#/$defs/Field_Change"
+                "$ref": "#/$defs/External_Reference"
               },
-              "description": "Detailed field-level changes between the before and after versions."
-            },
-            "oldId": {
-              "type": "string",
-              "description": "The requirement ID in the old source, if different from the canonical id."
+              "description": "Optional references to external artifacts relevant to this requirement (CTI/STIX correlation, advisories, control/definition sources, or any URI-addressable artifact). Applies to both baseline requirement definitions and evaluated requirements. Inert context; see External_Reference."
             },
-            "newId": {
+            "id": {
               "type": "string",
-              "description": "The requirement ID in the new source, if different from the canonical id."
+              "description": "The requirement identifier. Example: 'SV-238196'."
             },
             "title": {
               "type": "string",
-              "description": "The requirement title for human readability."
-            },
-            "oldEffectiveStatus": {
-              "type": "string",
-              "description": "The effective status of the requirement in the old source."
-            },
-            "newEffectiveStatus": {
-              "type": "string",
-              "description": "The effective status of the requirement in the new source."
-            },
-            "oldImpact": {
-              "type": "number",
-              "minimum": 0,
-              "maximum": 1,
-              "description": "The impact score of the requirement in the old source (0-1)."
-            },
-            "newImpact": {
-              "type": "number",
-              "minimum": 0,
-              "maximum": 1,
-              "description": "The impact score of the requirement in the new source (0-1)."
-            },
-            "matchStrategy": {
-              "$ref": "#/$defs/Match_Strategy",
-              "description": "The strategy that was used to match this requirement across sources."
-            },
-            "matchConfidence": {
-              "type": "number",
-              "minimum": 0,
-              "maximum": 1,
-              "description": "Confidence score for the match (0-1)."
-            },
-            "matchManual": {
-              "type": "boolean",
-              "description": "Whether the match was manually confirmed by a human."
+              "description": "The title - is nullable."
             },
-            "annotationIds": {
+            "descriptions": {
               "type": "array",
+              "minItems": 1,
               "items": {
-                "type": "string"
+                "type": "object",
+                "unevaluatedProperties": false,
+                "required": [
+                  "label",
+                  "data"
+                ],
+                "properties": {
+                  "label": {
+                    "type": "string",
+                    "description": "Description category. The 'default' label is required for the primary description. Common labels: 'default', 'check', 'fix', 'rationale'. Tools may use custom labels."
+                  },
+                  "data": {
+                    "type": "string",
+                    "description": "The description text content."
+                  }
+                }
               },
-              "description": "IDs of annotations attached to this requirement diff."
+              "description": "Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."
             },
-            "sourceIndex": {
-              "type": "integer",
+            "impact": {
+              "type": "number",
               "minimum": 0,
-              "description": "Index into the sources array for multi-source comparisons."
+              "maximum": 1,
+              "description": "The impactfulness or severity (0.0 to 1.0)."
             },
-            "conflicts": {
+            "refs": {
               "type": "array",
               "items": {
-                "$ref": "#/$defs/Scanner_Conflict"
+                "$ref": "#/$defs/Reference"
               },
-              "description": "Conflicts between multiple scanner results for this requirement."
+              "description": "The set of references to external documents."
             },
-            "beforeSensitive": {
+            "tags": {
               "type": "object",
               "additionalProperties": true,
-              "description": "Sensitive data from the old source that should not be included in the main before snapshot."
+              "description": "A set of tags - usually metadata like CCI, STIG ID, severity."
             },
-            "afterSensitive": {
-              "type": "object",
-              "additionalProperties": true,
-              "description": "Sensitive data from the new source that should not be included in the main after snapshot."
-            }
-          },
-          "description": "A comparison of a single requirement between sources, including state, changes, and full before/after snapshots.",
-          "title": "Requirement Diff"
-        }
-      }
-    },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0": {
-      "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0",
-      "title": "HDF Common Primitives",
-      "description": "Shared building blocks used by hdf-results and hdf-baseline schemas.",
-      "$defs": {
-        "Hash_Algorithm": {
-          "type": "string",
-          "enum": [
-            "sha256",
-            "sha384",
-            "sha512",
-            "blake3"
-          ],
-          "description": "Supported cryptographic hash algorithms for checksums and integrity verification. blake3 covers container-image and other artifact digests that use it.",
-          "title": "Hash Algorithm"
-        },
-        "Requirement_Group": {
-          "type": "object",
-          "unevaluatedProperties": false,
-          "required": [
-            "id",
-            "requirements"
-          ],
-          "properties": {
-            "id": {
-              "type": "string",
-              "description": "The unique identifier for the group. Example: the relative path to the file specifying the requirements."
-            },
-            "title": {
-              "type": "string",
-              "description": "The title of the group - should be human readable."
-            },
-            "requirements": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "description": "The set of requirements as specified by their ids in this group. Example: 'SV-238196'."
-            }
-          },
-          "description": "Describes a group of requirements, such as those defined in a single file.",
-          "title": "Requirement Group"
-        },
-        "Dependency": {
-          "type": "object",
-          "unevaluatedProperties": false,
-          "required": [],
-          "properties": {
-            "name": {
-              "type": "string",
-              "description": "The name or assigned alias."
-            },
-            "url": {
-              "type": "string",
-              "format": "uri-reference",
-              "description": "The address of the dependency."
-            },
-            "branch": {
-              "type": "string",
-              "description": "The branch name for a git repo."
-            },
-            "path": {
-              "type": "string",
-              "description": "The relative path if the dependency is locally available."
-            },
-            "statusMessage": {
+            "code": {
               "type": "string",
-              "description": "The reason for the status if it is 'failed' or 'skipped'."
+              "description": "The raw source code of the requirement. Set to null for manual-only requirements or requirements not yet implemented; use verificationMethod to disambiguate manual-by-design from manual-pending-automation. Note that if this is an overlay, it does not include the underlying source code."
             },
-            "status": {
-              "type": "string",
-              "description": "The status. Should be: 'loaded', 'failed', or 'skipped'."
+            "sourceLocation": {
+              "$ref": "#/$defs/Source_Location",
+              "description": "The explicit location of the requirement within the source code."
             },
-            "git": {
+            "controlType": {
               "type": "string",
-              "format": "uri",
-              "description": "The location of the git repo. Example: 'https://github.com/my-org/ubuntu-22.04-stig-baseline.git'."
+              "title": "Control Type",
+              "enum": [
+                "policy",
+                "procedure",
+                "technical",
+                "management",
+                "operational"
+              ],
+              "description": "Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A categories. 'policy' = an authored governance statement; 'procedure' = a documented process; 'technical' = an enforced technical configuration; 'management' = a programmatic/management activity; 'operational' = a recurring operational activity (e.g. AT, IR, MA families). Optional: when omitted, consumers may infer heuristically from family/id but should not assume a default."
             },
-            "supermarket": {
-              "type": "string",
-              "description": "The 'user/profilename' attribute for a Supermarket server."
+            "verificationMethod": {
+              "$ref": "#/$defs/Verification_Method_Enum",
+              "description": "How this requirement is intended to be verified. Disambiguates the two cases that null 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and runs without operator action; 'hybrid' = part automated, part manual. Optional: when omitted, consumers should not infer a default."
             },
-            "compliance": {
+            "applicability": {
               "type": "string",
-              "description": "The 'user/profilename' attribute for an Automate server."
+              "title": "Applicability",
+              "enum": [
+                "required",
+                "optional",
+                "advisory"
+              ],
+              "description": "Whether the requirement is mandatory within its baseline. Distinct from severity (risk weight) and status (lifecycle state). Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}). Optional: when omitted, consumers should treat the requirement as 'required' by convention."
             }
           },
           "examples": [
             {
-              "name": "ubuntu-22.04-baseline",
-              "url": "https://github.com/my-org/ubuntu-22.04-stig-baseline",
-              "git": "https://github.com/my-org/ubuntu-22.04-stig-baseline.git",
-              "branch": "main",
-              "status": "loaded"
-            },
-            {
-              "name": "ssl-tls-baseline",
-              "path": "../shared-baselines/ssl-tls",
-              "status": "loaded"
-            },
-            {
-              "name": "windows-2022-baseline",
-              "git": "https://github.com/security-org/windows-2022-stig.git",
-              "branch": "v1.2.0",
-              "status": "failed",
-              "statusMessage": "Unable to clone repository: authentication failed"
-            },
-            {
-              "name": "chef-supermarket-baseline",
-              "supermarket": "dev-sec/linux-baseline",
-              "status": "loaded"
-            }
-          ],
-          "description": "A dependency for a baseline. Can include relative paths or URLs for where to find the dependency.",
-          "title": "Dependency"
-        },
-        "Reference": {
-          "anyOf": [
-            {
-              "type": "object",
-              "required": [
-                "ref"
+              "$comment": "v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.5.0 (backward compatibility).",
+              "id": "SV-238196",
+              "title": "The Ubuntu operating system must enforce password complexity",
+              "impact": 0.5,
+              "tags": {
+                "nist": [
+                  "IA-5"
+                ],
+                "severity": "medium",
+                "cci": [
+                  "CCI-000192"
+                ]
+              },
+              "refs": [
+                {
+                  "url": "https://public.cyber.mil/stigs/"
+                }
               ],
-              "properties": {
-                "ref": {
-                  "anyOf": [
-                    {
-                      "type": "string",
-                      "description": "A human readable/meaningful reference. Example: a book title."
-                    },
-                    {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "additionalProperties": true
-                      },
-                      "description": "An array of reference objects."
-                    }
-                  ]
+              "descriptions": [
+                {
+                  "label": "default",
+                  "data": "Use of a complex password helps to increase the time and resources required to compromise the password."
+                },
+                {
+                  "label": "check",
+                  "data": "Verify the value of 'minlen' in /etc/security/pwquality.conf."
                 }
-              },
-              "description": "A reference using the 'ref' field."
+              ]
             },
             {
-              "type": "object",
-              "required": [
-                "url"
-              ],
-              "properties": {
-                "url": {
-                  "type": "string",
-                  "format": "uri"
-                }
+              "$comment": "v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline.",
+              "id": "AC-3",
+              "title": "Access Enforcement",
+              "impact": 0.7,
+              "tags": {
+                "nist": [
+                  "AC-3"
+                ],
+                "severity": "high"
               },
-              "description": "A URL pointing at the reference."
+              "descriptions": [
+                {
+                  "label": "default",
+                  "data": "The information system enforces approved authorizations for logical access to information and system resources."
+                }
+              ],
+              "code": "control 'AC-3' do; impact 0.7; end",
+              "controlType": "technical",
+              "verificationMethod": "automated",
+              "applicability": "required"
             },
             {
-              "type": "object",
-              "required": [
-                "uri"
-              ],
-              "properties": {
-                "uri": {
-                  "type": "string",
-                  "format": "uri"
+              "$comment": "v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement.",
+              "id": "KSI-CNA-01",
+              "title": "Cyber Security Plan documents the system",
+              "impact": 0.5,
+              "tags": {
+                "ksi": [
+                  "KSI-CNA"
+                ]
+              },
+              "descriptions": [
+                {
+                  "label": "default",
+                  "data": "The Cyber Security Plan documents the system, its boundary, and its components."
                 }
+              ],
+              "controlType": "policy",
+              "verificationMethod": "manual-by-design",
+              "applicability": "required"
+            },
+            {
+              "$comment": "v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
+              "id": "SV-999999",
+              "title": "Example STIG rule pending automation",
+              "impact": 0.3,
+              "tags": {
+                "stig_id": "SV-999999"
               },
-              "description": "A URI pointing at the reference."
+              "descriptions": [
+                {
+                  "label": "default",
+                  "data": "Example requirement that is intended to be automated but currently lacks a fix block."
+                },
+                {
+                  "label": "check",
+                  "data": "Manual review of system configuration is required."
+                }
+              ],
+              "verificationMethod": "manual-pending-automation",
+              "applicability": "advisory"
             }
           ],
-          "description": "A reference to an external document.",
-          "title": "Reference"
+          "description": "Core requirement fields shared between baseline requirements and evaluated requirements. Contains the fundamental requirement definition without assessment results.",
+          "title": "Requirement Core"
         },
-        "Source_Location": {
-          "type": "object",
-          "unevaluatedProperties": false,
-          "required": [],
-          "properties": {
-            "ref": {
-              "type": "string",
-              "description": "Path to the file that this requirement originates from."
-            },
-            "line": {
-              "type": "number",
-              "description": "The line on which this requirement is located."
-            }
-          },
-          "examples": [
-            {
-              "ref": "controls/SV-260476.rb",
-              "line": 1
-            },
-            {
-              "ref": "profiles/ubuntu/controls/configure_audit.rb",
-              "line": 42
-            }
+        "Verification_Method_Enum": {
+          "type": "string",
+          "enum": [
+            "automated",
+            "manual-by-design",
+            "manual-pending-automation",
+            "hybrid"
           ],
-          "description": "The explicit location of a requirement within source code.",
-          "title": "Source Location"
+          "description": "How a requirement is intended to be verified. Disambiguates the two cases that null 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and runs without operator action; 'hybrid' = part automated, part manual. Named '_Enum' to disambiguate from the unrelated Verification_Method DID-context struct.",
+          "title": "Verification Method Enum"
         },
-        "Supported_Platform": {
-          "type": "object",
-          "unevaluatedProperties": false,
-          "required": [],
-          "properties": {
-            "platformFamily": {
-              "type": "string",
-              "description": "The platform family. Example: 'redhat'."
-            },
-            "platformName": {
-              "type": "string",
-              "description": "The platform name - can include wildcards. Example: 'debian'."
-            },
-            "platform": {
-              "type": "string",
-              "description": "The location of the platform. Can be: 'os', 'aws', 'azure', or 'gcp'."
-            },
-            "release": {
-              "type": "string",
-              "description": "The release of the platform. Example: '20.04' for 'ubuntu'."
-            }
-          },
-          "description": "A supported platform target. Example: the platform name being 'ubuntu'.",
-          "title": "Supported Platform"
+        "Severity": {
+          "type": "string",
+          "enum": [
+            "critical",
+            "high",
+            "medium",
+            "low",
+            "informational"
+          ],
+          "description": "Severity rating for a requirement. Typically derived from the numeric impact score.",
+          "title": "Severity"
+        },
+        "Cloud_Provider": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "enum": [
+            "aws",
+            "azure",
+            "gcp",
+            "oci",
+            "other",
+            null
+          ],
+          "description": "Cloud service provider identifier.",
+          "title": "Cloud Provider"
+        }
+      }
+    },
+    "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0": {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0",
+      "title": "HDF Comparison Primitives",
+      "description": "Types for representing structured comparisons between HDF security assessment documents.",
+      "$defs": {
+        "Requirement_State": {
+          "type": "string",
+          "enum": [
+            "new",
+            "absent",
+            "unchanged",
+            "updated",
+            "fixed",
+            "regressed",
+            "moved",
+            "split",
+            "merged"
+          ],
+          "description": "SARIF-compatible vocabulary extended for security. 'new' = present only in new source, 'absent' = present only in old, 'unchanged' = same effective status, 'updated' = status changed (generic), 'fixed' = was failing now passing, 'regressed' = was passing now failing, 'moved' = reorganized same content, 'split'/'merged' = reserved for v1.1.",
+          "title": "Requirement State"
+        },
+        "Change_Reason": {
+          "type": "string",
+          "enum": [
+            "resultChanged",
+            "overrideAdded",
+            "overrideExpired",
+            "overrideRemoved",
+            "overrideModified",
+            "impactChanged",
+            "dispositionChanged",
+            "effectiveImpactChanged",
+            "baselineUpgraded",
+            "controlMapped",
+            "scannerChanged",
+            "targetChanged",
+            "configChanged",
+            "metadataChanged"
+          ],
+          "description": "The reason a requirement's state changed between sources. 'dispositionChanged' = the governing override type differs between the sources (e.g. a waiver replaced a riskAdjustment); 'effectiveImpactChanged' = the post-override impact score differs while the base impact may be unchanged.",
+          "title": "Change Reason"
+        },
+        "Comparison_Mode": {
+          "type": "string",
+          "enum": [
+            "temporal",
+            "baseline",
+            "fleet",
+            "multiSource",
+            "baselineEvolution",
+            "systemDrift"
+          ],
+          "description": "The mode of comparison. 'temporal' compares the same target over time. 'baseline' compares against a golden reference. 'fleet' compares across multiple systems. 'multiSource' compares outputs from different scanners. 'baselineEvolution' compares two baseline documents to detect requirement changes between versions. 'systemDrift' compares two system documents to detect component-level changes.",
+          "title": "Comparison Mode"
+        },
+        "Source_Role": {
+          "type": "string",
+          "enum": [
+            "old",
+            "new",
+            "golden",
+            "reference",
+            "system"
+          ],
+          "description": "The role of a source document in the comparison.",
+          "title": "Source Role"
+        },
+        "Original_Format": {
+          "type": "string",
+          "enum": [
+            "hdf-v2",
+            "inspec-v1",
+            "sarif",
+            "oscal-ar",
+            "xccdf"
+          ],
+          "description": "The original format of the source document before conversion to HDF.",
+          "title": "Original Format"
+        },
+        "Match_Strategy": {
+          "type": "string",
+          "enum": [
+            "exactId",
+            "mappedId",
+            "cciMatch",
+            "nistMatch",
+            "fuzzyTitle",
+            "fuzzyContent"
+          ],
+          "description": "The strategy used to match requirements across sources. 'exactId' matches by identical IDs. 'mappedId' uses an ID mapping table. 'cciMatch'/'nistMatch' match by framework identifiers. 'fuzzyTitle'/'fuzzyContent' use text similarity.",
+          "title": "Match Strategy"
+        },
+        "Conflict_Resolution": {
+          "type": "string",
+          "enum": [
+            "mostSevere",
+            "mostRecent",
+            "manual",
+            "unresolved"
+          ],
+          "description": "How a conflict between multiple scanner results was resolved.",
+          "title": "Conflict Resolution"
         },
-        "Checksum": {
+        "Annotation_Category": {
+          "type": "string",
+          "enum": [
+            "remediation",
+            "drift",
+            "waiver",
+            "baselineChange",
+            "scannerNote"
+          ],
+          "description": "The category of an annotation attached to a comparison.",
+          "title": "Annotation Category"
+        },
+        "Field_Change": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "algorithm",
-            "value"
+            "op",
+            "path"
           ],
           "properties": {
-            "algorithm": {
-              "$ref": "#/$defs/Hash_Algorithm",
-              "description": "The hash algorithm used for the checksum."
+            "op": {
+              "type": "string",
+              "title": "Op",
+              "enum": [
+                "add",
+                "remove",
+                "replace"
+              ],
+              "description": "The type of change operation."
             },
-            "value": {
+            "path": {
               "type": "string",
-              "description": "The checksum value."
-            }
-          },
-          "examples": [
-            {
-              "algorithm": "sha256",
-              "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+              "description": "JSON Pointer path to the changed field."
             },
-            {
-              "algorithm": "sha512",
-              "value": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e"
+            "oldValue": {
+              "description": "The previous value of the field (for 'remove' and 'replace' operations)."
+            },
+            "newValue": {
+              "description": "The new value of the field (for 'add' and 'replace' operations)."
             }
-          ],
-          "description": "Cryptographic checksum for baseline integrity verification.",
-          "title": "Checksum"
+          },
+          "description": "A single field-level change between two versions of a requirement.",
+          "title": "Field Change"
         },
-        "Identity": {
+        "Source": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "identifier",
-            "type"
+            "role",
+            "label"
           ],
           "properties": {
-            "identifier": {
+            "role": {
+              "$ref": "#/$defs/Source_Role",
+              "description": "The role of this source in the comparison."
+            },
+            "label": {
               "type": "string",
-              "description": "The identifier value. Example: 'user@example.com', 'jdoe', 'automated-scanner-01'."
+              "description": "Human-readable label for this source. Example: 'Before remediation scan'."
             },
-            "type": {
+            "uri": {
               "type": "string",
-              "title": "Identity Type",
-              "enum": [
-                "email",
-                "username",
-                "system",
-                "agent",
-                "simple",
-                "other"
-              ],
-              "description": "The type of identifier. Use 'email' for email addresses, 'username' for user accounts, 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent' for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF, 'simple' for basic string identifiers without additional classification, or 'other' for custom identity systems."
+              "format": "uri",
+              "description": "URI pointing to the source document."
             },
-            "description": {
+            "originalFormat": {
+              "$ref": "#/$defs/Original_Format",
+              "description": "The original format of the source document before conversion to HDF."
+            },
+            "checksum": {
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
+              "description": "Cryptographic checksum of the source document for integrity verification."
+            },
+            "assessmentTimestamp": {
               "type": "string",
-              "description": "Optional description of the identity or identity system, particularly useful when type is 'other'."
-            }
-          },
-          "examples": [
-            {
-              "type": "email",
-              "identifier": "admin@example.com"
+              "format": "date-time",
+              "description": "When the source assessment was performed. ISO 8601 format."
             },
-            {
-              "type": "username",
-              "identifier": "jdoe",
-              "description": "Security Operations Analyst"
+            "tool": {
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Tool",
+              "description": "The security tool that produced the assessment data in this source."
             },
-            {
-              "type": "system",
-              "identifier": "automated-scanner-01",
-              "description": "Nightly compliance scan pipeline"
+            "components": {
+              "type": "array",
+              "items": {
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"
+              },
+              "description": "The components assessed in this source."
             },
-            {
-              "type": "agent",
-              "identifier": "cve-enrichment-bot/v0.4.2",
-              "description": "OpenAI GPT-4 via internal CVE-enrichment tool; proposes environmental CVSS for human review"
+            "baselineRef": {
+              "type": "object",
+              "unevaluatedProperties": false,
+              "required": [
+                "name"
+              ],
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "description": "Name of the baseline used in this source."
+                },
+                "version": {
+                  "type": "string",
+                  "description": "Version of the baseline used in this source."
+                }
+              },
+              "description": "Reference to the baseline used in this source assessment."
             }
-          ],
-          "description": "Represents an identity that performed an action, such as capturing evidence or applying an override.",
-          "title": "Identity"
+          },
+          "description": "A source document participating in the comparison.",
+          "title": "Source"
         },
-        "Evidence": {
+        "Matching_Config": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "type",
-            "data"
+            "primaryStrategy"
           ],
           "properties": {
-            "type": {
-              "type": "string",
-              "title": "Evidence Type",
-              "enum": [
-                "screenshot",
-                "code",
-                "log",
-                "url",
-                "file",
-                "other"
-              ],
-              "description": "The type of evidence being provided."
-            },
-            "data": {
-              "type": "string",
-              "description": "The evidence content. For screenshots/files: base64-encoded data or URL. For code/logs: the raw text. For URLs: the URL string."
-            },
-            "description": {
-              "type": "string",
-              "description": "Human-readable description of what this evidence shows."
-            },
-            "mimeType": {
-              "type": "string",
-              "description": "MIME type of the evidence. Example: 'image/png', 'text/plain', 'application/json'."
+            "primaryStrategy": {
+              "$ref": "#/$defs/Match_Strategy",
+              "description": "The primary strategy used to match requirements across sources."
             },
-            "encoding": {
-              "type": "string",
-              "description": "Encoding used for the data. Example: 'base64', 'utf-8'."
+            "fallbackStrategies": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/Match_Strategy"
+              },
+              "description": "Ordered list of fallback strategies tried when the primary strategy fails to find a match."
             },
-            "size": {
+            "minimumConfidence": {
               "type": "number",
-              "description": "Size of the evidence data in bytes."
+              "minimum": 0,
+              "maximum": 1,
+              "description": "Minimum confidence score (0-1) required to accept a match."
             },
-            "capturedAt": {
+            "mappingTableUri": {
               "type": "string",
-              "format": "date-time",
-              "description": "Timestamp when this evidence was captured. ISO 8601 format."
+              "format": "uri",
+              "description": "URI pointing to an external mapping table used for ID translation."
             },
-            "capturedBy": {
-              "$ref": "#/$defs/Identity",
-              "description": "Identity of who or what captured this evidence."
+            "fingerprintFields": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Fields used to compute a fingerprint for fuzzy matching."
             }
           },
-          "examples": [
-            {
-              "type": "screenshot",
-              "data": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
-              "description": "Screenshot showing firewall configuration with required ports blocked",
-              "mimeType": "image/png",
-              "encoding": "base64",
-              "size": 95,
-              "capturedAt": "2025-12-14T10:30:00Z",
-              "capturedBy": {
-                "identifier": "security-auditor@example.com",
-                "type": "email"
-              }
+          "description": "Configuration for how requirements are matched across sources.",
+          "title": "Matching Config"
+        },
+        "State_Counts": {
+          "type": "object",
+          "unevaluatedProperties": false,
+          "properties": {
+            "fixed": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements that changed from failing to passing."
             },
-            {
-              "type": "code",
-              "data": "# Nginx configuration\nserver {\n  listen 443 ssl;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_ciphers HIGH:!aNULL:!MD5;\n}",
-              "description": "Server configuration showing TLS 1.2+ enforcement",
-              "mimeType": "text/plain",
-              "capturedAt": "2025-12-14T10:45:00Z"
+            "regressed": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements that changed from passing to failing."
+            },
+            "new": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements present only in the new source."
+            },
+            "absent": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements present only in the old source."
+            },
+            "unchanged": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements with the same effective status."
+            },
+            "updated": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements with a generic status change."
             },
-            {
-              "type": "log",
-              "data": "[2025-12-14 10:00:15] INFO: Security scan completed - 0 critical vulnerabilities found\n[2025-12-14 10:00:16] INFO: All required security patches applied\n[2025-12-14 10:00:17] INFO: System compliant with security baseline",
-              "description": "Security scan log output",
-              "mimeType": "text/plain",
-              "size": 256
+            "moved": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements that were reorganized without content change."
+            }
+          },
+          "description": "Counts of requirements in each state.",
+          "title": "State Counts"
+        },
+        "Severity_Breakdown": {
+          "type": "object",
+          "unevaluatedProperties": false,
+          "properties": {
+            "critical": {
+              "$ref": "#/$defs/State_Counts",
+              "description": "State counts for critical severity requirements."
             },
-            {
-              "type": "url",
-              "data": "https://jira.example.com/browse/SEC-12345",
-              "description": "Link to security ticket documenting remediation work",
-              "capturedAt": "2025-12-14T11:00:00Z"
+            "high": {
+              "$ref": "#/$defs/State_Counts",
+              "description": "State counts for high severity requirements."
             },
-            {
-              "type": "file",
-              "data": "UEsDBBQAAAAIAI1ZX1YhQp8FHgAAABIAAAAIAAAAdGVzdC50eHRLy8nPS8lQSgIAUmNEBhQAAAA=",
-              "description": "Compliance audit report PDF",
-              "mimeType": "application/pdf",
-              "encoding": "base64",
-              "size": 2048,
-              "capturedAt": "2025-12-14T12:00:00Z",
-              "capturedBy": {
-                "identifier": "compliance-system",
-                "type": "system"
-              }
+            "medium": {
+              "$ref": "#/$defs/State_Counts",
+              "description": "State counts for medium severity requirements."
+            },
+            "low": {
+              "$ref": "#/$defs/State_Counts",
+              "description": "State counts for low severity requirements."
             }
-          ],
-          "description": "Supporting evidence for a finding or override, such as screenshots, code samples, log excerpts, or URLs.",
-          "title": "Evidence"
+          },
+          "description": "Breakdown of state counts by severity level.",
+          "title": "Severity Breakdown"
         },
-        "Remediation": {
+        "Per_Source_Summary": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "uri"
+            "sourceIndex",
+            "label"
           ],
           "properties": {
-            "uri": {
+            "sourceIndex": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Zero-based index into the sources array identifying which source this summary is for."
+            },
+            "label": {
               "type": "string",
-              "format": "uri",
-              "description": "URI pointing to automated remediation resources (Ansible playbooks, Terraform scripts, etc.). Examples: GitHub repository, DISA STIG Supplemental Automation Content, vendor-provided scripts."
+              "description": "Human-readable label for this source."
             },
-            "checksum": {
-              "$ref": "#/$defs/Checksum",
-              "description": "Optional cryptographic checksum for verifying the integrity of remediation resources fetched from the URI. Recommended for security when referencing external automation scripts."
-            }
-          },
-          "examples": [
-            {
-              "uri": "https://github.com/ansible-lockdown/RHEL9-STIG/tree/main/tasks"
+            "fixed": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements that changed from failing to passing."
             },
-            {
-              "uri": "https://artifacts.example.com/remediation/ubuntu-22.04-hardening-v1.2.tar.gz",
-              "checksum": {
-                "algorithm": "sha256",
-                "value": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"
-              }
+            "regressed": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements that changed from passing to failing."
+            },
+            "new": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements present only in the new source."
+            },
+            "absent": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements present only in the old source."
+            },
+            "unchanged": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements with the same effective status."
+            },
+            "updated": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements with a generic status change."
+            },
+            "moved": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements that were reorganized without content change."
             }
-          ],
-          "description": "Reference to automated remediation resources for implementing security controls. Points to external automation content like Ansible playbooks, Terraform scripts, or vendor-provided remediation tools.",
-          "title": "Remediation"
+          },
+          "description": "Summary statistics for a single source in a multi-source comparison.",
+          "title": "Per Source Summary"
         },
-        "Verification_Method": {
+        "Comparison_Summary": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "type",
-            "controller"
+            "total",
+            "matchedCount",
+            "unmatchedOldCount",
+            "unmatchedNewCount"
           ],
           "properties": {
-            "type": {
-              "type": "string",
-              "description": "The type of verification method. Example: 'JsonWebKey2020', 'RsaVerificationKey2018', 'Ed25519VerificationKey2020'."
+            "total": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Total number of unique requirements across all sources."
             },
-            "controller": {
-              "type": "string",
-              "description": "The entity that controls this verification method. Can be a DID, URI, or other identifier."
+            "matchedCount": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements successfully matched between sources."
             },
-            "publicKeyJwk": {
-              "type": "object",
-              "additionalProperties": true,
-              "description": "Public key in JSON Web Key format."
+            "unmatchedOldCount": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements in the old source with no match in the new source."
             },
-            "publicKeyPem": {
-              "type": "string",
-              "description": "Public key in PEM format. Example: '-----BEGIN PUBLIC KEY-----...-----END PUBLIC KEY-----'."
+            "unmatchedNewCount": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements in the new source with no match in the old source."
             },
-            "publicKeyBase58": {
-              "type": "string",
-              "description": "Public key in Base58 format, commonly used with Ed25519 keys."
+            "new": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements present only in the new source."
+            },
+            "absent": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements present only in the old source."
+            },
+            "unchanged": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements with the same effective status."
+            },
+            "updated": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements with a generic status change."
+            },
+            "fixed": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements that changed from failing to passing."
+            },
+            "regressed": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements that changed from passing to failing."
+            },
+            "moved": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of requirements that were reorganized without content change."
+            },
+            "oldCompliancePercent": {
+              "type": "number",
+              "description": "Compliance percentage of the old source (0-100)."
+            },
+            "newCompliancePercent": {
+              "type": "number",
+              "description": "Compliance percentage of the new source (0-100)."
+            },
+            "complianceDelta": {
+              "type": "number",
+              "description": "Change in compliance percentage (new - old)."
+            },
+            "averageMatchConfidence": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 1,
+              "description": "Average confidence score across all requirement matches (0-1)."
+            },
+            "bySeverity": {
+              "$ref": "#/$defs/Severity_Breakdown",
+              "description": "State counts broken down by severity level."
+            },
+            "perSource": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/Per_Source_Summary"
+              },
+              "description": "Summary statistics for each individual source in a multi-source comparison."
             }
           },
-          "description": "Verification method containing the public key needed to verify a digital signature. Supports multiple key formats including JWK (for RSA, EC), PEM, and Base58.",
-          "title": "Verification Method"
+          "description": "Summary statistics for the overall comparison.",
+          "title": "Comparison Summary"
         },
-        "Milestone": {
+        "Baseline_Diff": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "description",
-            "estimatedCompletion",
-            "status"
+            "name",
+            "state"
           ],
           "properties": {
-            "description": {
-              "type": "string",
-              "description": "Description of this milestone or task."
-            },
-            "estimatedCompletion": {
+            "name": {
               "type": "string",
-              "format": "date-time",
-              "description": "Estimated completion date. ISO 8601 format."
+              "description": "Name of the baseline being compared."
             },
-            "status": {
+            "state": {
               "type": "string",
-              "title": "Milestone Status",
+              "title": "Baseline Diff State",
               "enum": [
-                "pending",
-                "inProgress",
-                "completed"
+                "new",
+                "absent",
+                "unchanged",
+                "updated"
               ],
-              "description": "Current status of this milestone."
+              "description": "The state of this baseline in the comparison."
             },
-            "completedAt": {
+            "oldVersion": {
               "type": "string",
-              "format": "date-time",
-              "description": "Actual completion timestamp. ISO 8601 format."
+              "description": "Version of the baseline in the old source."
             },
-            "completedBy": {
-              "$ref": "#/$defs/Identity",
-              "description": "Identity of who completed this milestone."
+            "newVersion": {
+              "type": "string",
+              "description": "Version of the baseline in the new source."
+            },
+            "mappingSource": {
+              "type": "string",
+              "description": "The source of any ID mapping used to correlate requirements across baseline versions."
             }
           },
-          "description": "A milestone or task within a POA&M remediation plan.",
-          "title": "Milestone"
+          "description": "Comparison of a baseline between sources.",
+          "title": "Baseline Diff"
         },
-        "Signature": {
+        "Component_Diff": {
           "type": "object",
           "unevaluatedProperties": false,
           "required": [
-            "type",
-            "created",
-            "creator",
-            "signatureValue",
-            "proofPurpose",
-            "verificationMethod"
+            "name",
+            "state"
           ],
           "properties": {
-            "type": {
-              "type": "string",
-              "description": "The signature suite type. Example: 'JsonWebSignature2020', 'RsaSignature2018', 'Ed25519Signature2020'."
-            },
-            "created": {
-              "type": "string",
-              "format": "date-time",
-              "description": "When the signature was created. ISO 8601 format."
-            },
-            "creator": {
-              "$ref": "#/$defs/Identity",
-              "description": "The identity that created this signature."
-            },
-            "signatureValue": {
+            "name": {
               "type": "string",
-              "description": "The base64-encoded or base58-encoded signature value."
+              "description": "Component name used for matching across system versions."
             },
-            "proofPurpose": {
+            "state": {
               "type": "string",
-              "description": "The purpose of this signature. Example: 'attestation', 'authentication', 'assertionMethod'."
-            },
-            "verificationMethod": {
-              "$ref": "#/$defs/Verification_Method",
-              "description": "The verification method containing the public key for signature verification."
+              "title": "Baseline Diff State",
+              "enum": [
+                "new",
+                "absent",
+                "unchanged",
+                "updated"
+              ],
+              "description": "The state of this component in the comparison."
             },
-            "nonce": {
-              "type": "string",
-              "description": "Random value to prevent replay attacks."
+            "before": {
+              "oneOf": [
+                {
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Component snapshot from the old system document. Null when state is 'new'."
             },
-            "challenge": {
-              "type": "string",
-              "description": "Challenge value from the verifier, used in challenge-response authentication."
+            "after": {
+              "oneOf": [
+                {
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Component snapshot from the new system document. Null when state is 'absent'."
             },
-            "domain": {
-              "type": "string",
-              "description": "Domain restriction for the signature, prevents cross-domain replay attacks."
+            "fieldChanges": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/Field_Change"
+              },
+              "description": "Detailed field-level changes between the before and after component snapshots."
             }
           },
-          "examples": [
-            {
-              "type": "JsonWebSignature2020",
-              "created": "2025-12-14T10:00:00Z",
-              "creator": {
-                "identifier": "security-team@example.com",
-                "type": "email"
-              },
-              "signatureValue": "eyJhbGciOiJSUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..MEYCIQDvKbtLRhWAa",
-              "proofPurpose": "attestation",
-              "verificationMethod": {
-                "type": "JsonWebKey2020",
-                "controller": "did:example:123456789abcdefghi",
-                "publicKeyJwk": {
-                  "kty": "RSA",
-                  "n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtV",
-                  "e": "AQAB"
-                }
-              }
-            },
+          "description": "Comparison of a single component between two system document versions.",
+          "title": "Component Diff"
+        },
+        "Package_Diff": {
+          "type": "object",
+          "unevaluatedProperties": false,
+          "required": [
+            "state"
+          ],
+          "anyOf": [
             {
-              "type": "RsaSignature2018",
-              "created": "2025-12-14T11:30:00Z",
-              "creator": {
-                "identifier": "ciso@example.com",
-                "type": "email"
-              },
-              "signatureValue": "pY9...Cg==",
-              "proofPurpose": "authentication",
-              "verificationMethod": {
-                "type": "RsaVerificationKey2018",
-                "controller": "https://example.com/issuers/565049",
-                "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAryQICCl6NZ5gDKrnSztO\n-----END PUBLIC KEY-----"
-              },
-              "nonce": "c0ae1c8e-c7e7-469f-b252-86e6a0e7387e"
+              "required": [
+                "purl"
+              ]
             },
             {
-              "type": "Ed25519Signature2020",
-              "created": "2025-12-14T14:00:00Z",
-              "creator": {
-                "identifier": "automated-signer",
-                "type": "system",
-                "description": "Hardware security module (HSM) for automated attestations"
-              },
-              "signatureValue": "z58DAdFfa9SkqZMVMxABEBC59Ck6WibLZ",
-              "proofPurpose": "assertionMethod",
-              "verificationMethod": {
-                "type": "Ed25519VerificationKey2020",
-                "controller": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
-                "publicKeyBase58": "H3C2AVvLMv6gmMNam3uVAjZpfkcJCwDwnZn6z3wXmqPV"
-              },
-              "challenge": "1f44d2f3-d16c-47a4-9f5f-1d6e8f4e3a2b",
-              "domain": "https://compliance.example.com"
+              "required": [
+                "identifier"
+              ]
             }
           ],
-          "description": "A digital signature following W3C Data Integrity Proofs pattern. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other cryptographic signing methods via JWK, PEM, or Base58 key formats.",
-          "title": "Signature"
-        },
-        "Baseline_Metadata": {
-          "type": "object",
           "properties": {
-            "name": {
-              "type": "string",
-              "description": "The name - must be unique."
-            },
-            "title": {
-              "type": "string",
-              "description": "The title - should be human readable."
-            },
-            "maintainer": {
+            "purl": {
               "type": "string",
-              "description": "The maintainer(s)."
+              "description": "Package URL (purl) — the preferred identity key for matching software packages across BOMs. Optional: BOM nodes without a purl (AI models, datasets, hardware parts, crypto algorithms) key on identifier instead."
             },
-            "copyright": {
+            "identifier": {
               "type": "string",
-              "description": "The copyright holder(s)."
+              "description": "Generic identity key for matching a BOM node across versions when no purl applies — e.g. a Hugging Face model ref, dataset uniqueId, crypto algorithm OID, or hardware part number. At least one of purl or identifier is required."
             },
-            "copyrightEmail": {
+            "name": {
               "type": "string",
-              "description": "The email address or other contact information of the copyright holder(s)."
+              "description": "Human-readable node name."
             },
-            "license": {
+            "state": {
               "type": "string",
-              "description": "The copyright license. Example: 'Apache-2.0'."
+              "title": "Package Diff State",
+              "enum": [
+                "added",
+                "removed",
+                "updated",
+                "unchanged"
+              ],
+              "description": "The state of this package: added (new in new SBOM), removed (absent from new SBOM), updated (version changed), unchanged."
             },
-            "summary": {
+            "oldVersion": {
               "type": "string",
-              "description": "The summary. Example: the Security Technical Implementation Guide (STIG) header."
+              "description": "Package version in the old SBOM."
             },
-            "version": {
+            "newVersion": {
               "type": "string",
-              "description": "The version of the baseline."
+              "description": "Package version in the new SBOM."
             },
-            "supports": {
+            "licenses": {
               "type": "array",
               "items": {
-                "$ref": "#/$defs/Supported_Platform"
-              },
-              "description": "The set of supported platform targets."
-            },
-            "status": {
-              "type": "string",
-              "description": "The status. Example: 'loaded'."
-            },
-            "labels": {
-              "type": "object",
-              "additionalProperties": {
                 "type": "string"
               },
-              "description": "Optional key-value labels for flexible grouping. Well-known keys: system, component, environment, region, team. Values must be strings."
+              "description": "License identifiers for this package."
             }
           },
           "examples": [
             {
-              "name": "rhel-9-stig-baseline",
-              "title": "Red Hat Enterprise Linux 9 STIG Baseline",
-              "maintainer": "MITRE SAF Team",
-              "copyright": "The MITRE Corporation",
-              "copyrightEmail": "saf@mitre.org",
-              "license": "Apache-2.0",
-              "summary": "InSpec baseline for RHEL 9 STIG compliance",
-              "version": "1.0.0",
-              "supports": [
-                {
-                  "platformName": "redhat",
-                  "platformFamily": "redhat",
-                  "release": "9"
-                }
-              ],
-              "status": "loaded"
+              "$comment": "Software package diff keyed by purl (the SBOM case).",
+              "purl": "pkg:npm/express@4.18.2",
+              "name": "express",
+              "state": "updated",
+              "oldVersion": "4.18.1",
+              "newVersion": "4.18.2"
+            },
+            {
+              "$comment": "AI-model node diff keyed by identifier when no purl applies.",
+              "identifier": "acme/llama-2-7b-chat-support",
+              "name": "Llama-2-7b-chat (finetuned)",
+              "state": "added",
+              "newVersion": "1.2.0"
             }
           ],
-          "description": "Shared metadata fields for baselines. Used in both standalone baseline documents and evaluated baseline results.",
-          "title": "Baseline Metadata"
+          "description": "Comparison of a single BOM node between two BOM versions, matched by purl (software) or identifier (models, datasets, hardware, crypto).",
+          "title": "Package Diff"
         },
-        "Requirement_Core": {
+        "Scanner_Conflict": {
           "type": "object",
+          "unevaluatedProperties": false,
+          "required": [
+            "field",
+            "values"
+          ],
           "properties": {
-            "id": {
-              "type": "string",
-              "description": "The requirement identifier. Example: 'SV-238196'."
-            },
-            "title": {
+            "field": {
               "type": "string",
-              "description": "The title - is nullable."
+              "description": "The field where the conflict occurs."
             },
-            "descriptions": {
+            "values": {
               "type": "array",
-              "minItems": 1,
               "items": {
                 "type": "object",
                 "unevaluatedProperties": false,
                 "required": [
-                  "label",
-                  "data"
+                  "sourceIndex",
+                  "sourceLabel",
+                  "value"
                 ],
                 "properties": {
-                  "label": {
-                    "type": "string",
-                    "description": "Description category. The 'default' label is required for the primary description. Common labels: 'default', 'check', 'fix', 'rationale'. Tools may use custom labels."
+                  "sourceIndex": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "Zero-based index into the sources array."
                   },
-                  "data": {
+                  "sourceLabel": {
                     "type": "string",
-                    "description": "The description text content."
+                    "description": "Human-readable label for the source."
+                  },
+                  "value": {
+                    "description": "The value reported by this source for the conflicting field."
                   }
                 }
               },
-              "description": "Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."
+              "description": "The conflicting values from each source."
             },
-            "impact": {
-              "type": "number",
+            "resolvedIndex": {
+              "type": "integer",
               "minimum": 0,
-              "maximum": 1,
-              "description": "The impactfulness or severity (0.0 to 1.0)."
-            },
-            "refs": {
-              "type": "array",
-              "items": {
-                "$ref": "#/$defs/Reference"
-              },
-              "description": "The set of references to external documents."
-            },
-            "tags": {
-              "type": "object",
-              "additionalProperties": true,
-              "description": "A set of tags - usually metadata like CCI, STIG ID, severity."
+              "description": "Index of the source whose value was chosen as the resolution."
             },
-            "code": {
+            "resolution": {
+              "$ref": "#/$defs/Conflict_Resolution",
+              "description": "How the conflict was resolved."
+            }
+          },
+          "description": "A conflict between scanner results for the same requirement.",
+          "title": "Scanner Conflict"
+        },
+        "Annotation": {
+          "type": "object",
+          "unevaluatedProperties": false,
+          "required": [
+            "label"
+          ],
+          "properties": {
+            "label": {
               "type": "string",
-              "description": "The raw source code of the requirement. Set to null for manual-only requirements or requirements not yet implemented; use verificationMethod to disambiguate manual-by-design from manual-pending-automation. Note that if this is an overlay, it does not include the underlying source code."
-            },
-            "sourceLocation": {
-              "$ref": "#/$defs/Source_Location",
-              "description": "The explicit location of the requirement within the source code."
+              "description": "Human-readable label for this annotation."
             },
-            "controlType": {
+            "description": {
               "type": "string",
-              "title": "Control Type",
-              "enum": [
-                "policy",
-                "procedure",
-                "technical",
-                "management",
-                "operational"
-              ],
-              "description": "Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A categories. 'policy' = an authored governance statement; 'procedure' = a documented process; 'technical' = an enforced technical configuration; 'management' = a programmatic/management activity; 'operational' = a recurring operational activity (e.g. AT, IR, MA families). Optional: when omitted, consumers may infer heuristically from family/id but should not assume a default."
+              "description": "Detailed description of the annotation."
             },
-            "verificationMethod": {
-              "$ref": "#/$defs/Verification_Method_Enum",
-              "description": "How this requirement is intended to be verified. Disambiguates the two cases that null 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and runs without operator action; 'hybrid' = part automated, part manual. Optional: when omitted, consumers should not infer a default."
+            "category": {
+              "$ref": "#/$defs/Annotation_Category",
+              "description": "The category of this annotation."
             },
-            "applicability": {
-              "type": "string",
-              "title": "Applicability",
-              "enum": [
-                "required",
-                "optional",
-                "advisory"
-              ],
-              "description": "Whether the requirement is mandatory within its baseline. Distinct from severity (risk weight) and status (lifecycle state). Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}). Optional: when omitted, consumers should treat the requirement as 'required' by convention."
+            "needsConfirmation": {
+              "type": "boolean",
+              "description": "Whether this annotation requires human confirmation before acting on it."
             }
           },
-          "examples": [
-            {
-              "$comment": "v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.4.0 (backward compatibility).",
-              "id": "SV-238196",
-              "title": "The Ubuntu operating system must enforce password complexity",
-              "impact": 0.5,
-              "tags": {
-                "nist": [
-                  "IA-5"
-                ],
-                "severity": "medium",
-                "cci": [
-                  "CCI-000192"
-                ]
+          "description": "An annotation attached to a comparison, providing context or action items.",
+          "title": "Annotation"
+        },
+        "Requirement_Diff": {
+          "type": "object",
+          "unevaluatedProperties": false,
+          "required": [
+            "id",
+            "state",
+            "changeReasons",
+            "before",
+            "after",
+            "fieldChanges"
+          ],
+          "properties": {
+            "id": {
+              "type": "string",
+              "description": "The canonical requirement identifier used for this diff."
+            },
+            "state": {
+              "$ref": "#/$defs/Requirement_State",
+              "description": "The state of this requirement in the comparison."
+            },
+            "changeReasons": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/Change_Reason"
               },
-              "refs": [
+              "description": "The reasons for the state change."
+            },
+            "before": {
+              "oneOf": [
                 {
-                  "url": "https://public.cyber.mil/stigs/"
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0#/$defs/Evaluated_Requirement"
+                },
+                {
+                  "type": "null"
                 }
               ],
-              "descriptions": [
+              "description": "The requirement as it appeared in the old/reference source. Null when state is 'new'."
+            },
+            "after": {
+              "oneOf": [
                 {
-                  "label": "default",
-                  "data": "Use of a complex password helps to increase the time and resources required to compromise the password."
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0#/$defs/Evaluated_Requirement"
                 },
                 {
-                  "label": "check",
-                  "data": "Verify the value of 'minlen' in /etc/security/pwquality.conf."
+                  "type": "null"
                 }
-              ]
+              ],
+              "description": "The requirement as it appeared in the new source. Null when state is 'absent'."
             },
-            {
-              "$comment": "v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline.",
-              "id": "AC-3",
-              "title": "Access Enforcement",
-              "impact": 0.7,
-              "tags": {
-                "nist": [
-                  "AC-3"
-                ],
-                "severity": "high"
+            "fieldChanges": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/Field_Change"
               },
-              "descriptions": [
-                {
-                  "label": "default",
-                  "data": "The information system enforces approved authorizations for logical access to information and system resources."
-                }
-              ],
-              "code": "control 'AC-3' do; impact 0.7; end",
-              "controlType": "technical",
-              "verificationMethod": "automated",
-              "applicability": "required"
+              "description": "Detailed field-level changes between the before and after versions."
             },
-            {
-              "$comment": "v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement.",
-              "id": "KSI-CNA-01",
-              "title": "Cyber Security Plan documents the system",
-              "impact": 0.5,
-              "tags": {
-                "ksi": [
-                  "KSI-CNA"
-                ]
+            "oldId": {
+              "type": "string",
+              "description": "The requirement ID in the old source, if different from the canonical id."
+            },
+            "newId": {
+              "type": "string",
+              "description": "The requirement ID in the new source, if different from the canonical id."
+            },
+            "title": {
+              "type": "string",
+              "description": "The requirement title for human readability."
+            },
+            "oldEffectiveStatus": {
+              "type": "string",
+              "description": "The effective status of the requirement in the old source."
+            },
+            "newEffectiveStatus": {
+              "type": "string",
+              "description": "The effective status of the requirement in the new source."
+            },
+            "oldImpact": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 1,
+              "description": "The impact score of the requirement in the old source (0-1)."
+            },
+            "newImpact": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 1,
+              "description": "The impact score of the requirement in the new source (0-1)."
+            },
+            "matchStrategy": {
+              "$ref": "#/$defs/Match_Strategy",
+              "description": "The strategy that was used to match this requirement across sources."
+            },
+            "matchConfidence": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 1,
+              "description": "Confidence score for the match (0-1)."
+            },
+            "matchManual": {
+              "type": "boolean",
+              "description": "Whether the match was manually confirmed by a human."
+            },
+            "annotationIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
               },
-              "descriptions": [
-                {
-                  "label": "default",
-                  "data": "The Cyber Security Plan documents the system, its boundary, and its components."
-                }
-              ],
-              "controlType": "policy",
-              "verificationMethod": "manual-by-design",
-              "applicability": "required"
+              "description": "IDs of annotations attached to this requirement diff."
             },
-            {
-              "$comment": "v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
-              "id": "SV-999999",
-              "title": "Example STIG rule pending automation",
-              "impact": 0.3,
-              "tags": {
-                "stig_id": "SV-999999"
+            "sourceIndex": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Index into the sources array for multi-source comparisons."
+            },
+            "conflicts": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/Scanner_Conflict"
               },
-              "descriptions": [
-                {
-                  "label": "default",
-                  "data": "Example requirement that is intended to be automated but currently lacks a fix block."
-                },
-                {
-                  "label": "check",
-                  "data": "Manual review of system configuration is required."
-                }
-              ],
-              "verificationMethod": "manual-pending-automation",
-              "applicability": "advisory"
+              "description": "Conflicts between multiple scanner results for this requirement."
+            },
+            "beforeSensitive": {
+              "type": "object",
+              "additionalProperties": true,
+              "description": "Sensitive data from the old source that should not be included in the main before snapshot."
+            },
+            "afterSensitive": {
+              "type": "object",
+              "additionalProperties": true,
+              "description": "Sensitive data from the new source that should not be included in the main after snapshot."
             }
-          ],
-          "description": "Core requirement fields shared between baseline requirements and evaluated requirements. Contains the fundamental requirement definition without assessment results.",
-          "title": "Requirement Core"
-        },
-        "Verification_Method_Enum": {
-          "type": "string",
-          "enum": [
-            "automated",
-            "manual-by-design",
-            "manual-pending-automation",
-            "hybrid"
-          ],
-          "description": "How a requirement is intended to be verified. Disambiguates the two cases that null 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and runs without operator action; 'hybrid' = part automated, part manual. Named '_Enum' to disambiguate from the unrelated Verification_Method DID-context struct.",
-          "title": "Verification Method Enum"
-        },
-        "Severity": {
-          "type": "string",
-          "enum": [
-            "critical",
-            "high",
-            "medium",
-            "low",
-            "informational"
-          ],
-          "description": "Severity rating for a requirement. Typically derived from the numeric impact score.",
-          "title": "Severity"
-        },
-        "Cloud_Provider": {
-          "type": [
-            "string",
-            "null"
-          ],
-          "enum": [
-            "aws",
-            "azure",
-            "gcp",
-            "oci",
-            "other",
-            null
-          ],
-          "description": "Cloud service provider identifier.",
-          "title": "Cloud Provider"
+          },
+          "description": "A comparison of a single requirement between sources, including state, changes, and full before/after snapshots.",
+          "title": "Requirement Diff"
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0",
       "title": "HDF Extension Primitives",
       "description": "Extension types for waivers, attestations, generators, and integrity.",
       "$defs": {
@@ -1926,16 +2077,23 @@
             }
           ],
           "properties": {
+            "externalReferences": {
+              "type": "array",
+              "items": {
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
+              },
+              "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object or CTI feed motivating an E:A riskAdjustment). Inert context distinct from `evidence`; see External_Reference. Symmetric with Standalone_Override.externalReferences for the inline (results-embedded) override carrier."
+            },
             "type": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.4.0#/$defs/Override_Type",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Override_Type",
               "description": "The type of override applied to this requirement."
             },
             "status": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.4.0#/$defs/Result_Status",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
               "description": "The new status this override sets for the requirement. Optional when only impact is being overridden."
             },
             "impact": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.4.0#/$defs/Impact_Override",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Impact_Override",
               "description": "Override to the requirement's impact score. At least one of status or impact must be set."
             },
             "reason": {
@@ -1943,7 +2101,7 @@
               "description": "Explanation for why this override was applied."
             },
             "appliedBy": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
               "description": "Identity of who applied this override. For simple cases, use type 'simple' with just an identifier."
             },
             "appliedAt": {
@@ -1957,27 +2115,27 @@
               "description": "Timestamp when this override expires and must be reviewed/renewed. REQUIRED - no permanent overrides allowed. ISO 8601 format."
             },
             "signature": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Signature",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature",
               "description": "Optional digital signature for enhanced trust and non-repudiation. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other signing methods."
             },
             "evidence": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Evidence"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
               },
               "description": "Supporting evidence for this override, such as screenshots demonstrating manual verification for attestations."
             },
             "previousChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
               "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
             },
             "cvss": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.4.0#/$defs/Cvss",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
               "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
               "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
             },
             "justification": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.4.0#/$defs/Justification",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Justification",
               "description": "Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."
             }
           },
@@ -2006,6 +2164,34 @@
               "appliedAt": "2026-04-14T10:00:00Z",
               "expiresAt": "2026-10-14T00:00:00Z"
             },
+            {
+              "$comment": "Inline riskAdjustment carrying the STIX source that motivated it via externalReferences (the enrichment envelope, with the raw sighting embedded losslessly in document). This is the shape the enrich pass writes onto Evaluated_Requirement.overrides[] for the E:A recompute.",
+              "type": "riskAdjustment",
+              "impact": {
+                "value": 0.9
+              },
+              "reason": "CVE-2021-44228 actively exploited in the wild per STIX threat intelligence",
+              "appliedBy": {
+                "identifier": "secops@agency.gov",
+                "type": "email"
+              },
+              "appliedAt": "2026-07-27T00:00:00Z",
+              "expiresAt": "2026-10-25T00:00:00Z",
+              "externalReferences": [
+                {
+                  "sourceName": "stix",
+                  "externalId": "sighting--a1b2c3d4-0000-4a2b-9c3d-000000000002",
+                  "kind": "threat-intel",
+                  "rel": "evidence",
+                  "document": {
+                    "type": "sighting",
+                    "spec_version": "2.1",
+                    "id": "sighting--a1b2c3d4-0000-4a2b-9c3d-000000000002",
+                    "sighting_of_ref": "vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001"
+                  }
+                }
+              ]
+            },
             {
               "type": "falsePositive",
               "status": "passed",
@@ -2065,7 +2251,8 @@
             "type",
             "explanation",
             "appliedBy",
-            "appliedAt"
+            "appliedAt",
+            "expiresAt"
           ],
           "properties": {
             "type": {
@@ -2084,7 +2271,7 @@
               "description": "Detailed explanation of the plan, including what actions will be taken."
             },
             "appliedBy": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
               "description": "Identity of who created this POA&M. For simple cases, use type 'simple' with just an identifier."
             },
             "appliedAt": {
@@ -2095,28 +2282,28 @@
             "expiresAt": {
               "type": "string",
               "format": "date-time",
-              "description": "Optional expiration date for this POA&M requiring review/renewal. ISO 8601 format."
+              "description": "Required deadline for this POA&M. A POA&M is a time-boxed acceptance of an open finding; without a deadline it lets a failing requirement duck remediation indefinitely. Source a real date (e.g. a remediation target or vendor-fix date) — never a wall-clock default. ISO 8601 format."
             },
             "milestones": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Milestone"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"
               },
               "description": "Optional array of milestones tracking progress toward completion."
             },
             "signature": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Signature",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature",
               "description": "Optional digital signature for enhanced trust and non-repudiation."
             },
             "evidence": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Evidence"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
               },
               "description": "Supporting evidence for this POA&M, such as documentation of compensating controls or mitigation implementation."
             },
             "previousChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
               "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
             }
           },
@@ -2129,6 +2316,7 @@
                 "type": "email"
               },
               "appliedAt": "2025-12-01T09:00:00Z",
+              "expiresAt": "2099-12-31T00:00:00Z",
               "milestones": [
                 {
                   "description": "Update base Docker image to use OpenSSL 3.0.x",
@@ -2161,7 +2349,7 @@
                 "description": "Automated POA&M creation from vulnerability scan"
               },
               "appliedAt": "2025-11-28T14:00:00Z",
-              "expiresAt": "2026-02-28T00:00:00Z",
+              "expiresAt": "2099-12-31T00:00:00Z",
               "milestones": [
                 {
                   "description": "Configure firewall rules to restrict database access to management VLAN",
@@ -2196,7 +2384,7 @@
                 "type": "email"
               },
               "appliedAt": "2025-12-05T10:00:00Z",
-              "expiresAt": "2026-04-01T00:00:00Z",
+              "expiresAt": "2099-12-31T00:00:00Z",
               "milestones": [
                 {
                   "description": "Complete migration to replacement system",
@@ -2248,7 +2436,8 @@
             },
             "format": {
               "type": "string",
-              "description": "The file format, if it is a recognized named format shared by multiple tools. Examples: 'SARIF', 'XCCDF'. Omit for tool-specific formats where the tool name already implies the format (Nessus XML, gosec JSON)."
+              "description": "The named format of the source data, when it follows a recognized format specification with its own identity: an interchange format emitted by many tools ('SARIF', 'XCCDF', 'OSCAL') or one of several named output formats a single tool produces ('FVDL', 'exec-json', 'FPF'). Never a serialization structure — 'JSON', 'XML', and 'CSV' are encodings, not formats. Omit for a tool's native output: an absent format means the tool's own shape, and data arriving as a named format is converted by that format's converter, which sets this field alongside the producing tool's name.",
+              "$comment": "Format-not-serialization rule decided 2026-08-01; bare JSON/XML/CSV labels were swept from the converters at the same time."
             }
           },
           "description": "The security tool that produced the assessment data represented in this HDF file. Aligns with SARIF, OSCAL, and CycloneDX terminology.",
@@ -2267,7 +2456,7 @@
           },
           "properties": {
             "algorithm": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Hash_Algorithm",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Hash_Algorithm",
               "description": "The hash algorithm used for the checksum."
             },
             "checksum": {
@@ -2300,9 +2489,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0",
       "title": "HDF Amendment Primitives",
       "description": "Types for waivers, attestations, and POA&Ms that modify requirement compliance status.",
       "$defs": {
@@ -2410,6 +2599,13 @@
             ]
           },
           "properties": {
+            "externalReferences": {
+              "type": "array",
+              "items": {
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
+              },
+              "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from `evidence`; see External_Reference."
+            },
             "type": {
               "$ref": "#/$defs/Override_Type",
               "description": "The type of amendment."
@@ -2423,7 +2619,7 @@
               "description": "Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."
             },
             "status": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.4.0#/$defs/Result_Status",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
               "description": "The new status this amendment sets. Optional when only impact is being overridden."
             },
             "impact": {
@@ -2435,7 +2631,7 @@
               "description": "Justification for this amendment."
             },
             "appliedBy": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
               "description": "Identity of who applied this amendment."
             },
             "appliedAt": {
@@ -2451,20 +2647,20 @@
             "evidence": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Evidence"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
               },
               "description": "Supporting evidence (screenshots, logs, URLs, documents)."
             },
             "signature": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Signature",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature",
               "description": "Digital signature for non-repudiation."
             },
             "previousChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
               "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
             },
             "cvss": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.4.0#/$defs/Cvss",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
               "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
               "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
             },
@@ -2475,7 +2671,7 @@
             "milestones": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Milestone"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"
               },
               "description": "Remediation milestones (primarily for POA&M type amendments)."
             },
@@ -2492,7 +2688,7 @@
             "affectedPackages": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.4.0#/$defs/Affected_Package"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0#/$defs/Affected_Package"
               },
               "description": "Software packages this amendment is scoped to, distinct from componentRef (which scopes to an HDF-internal Component by UUID). Use when the source amendment format references packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware amendments. Symmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same package vocabulary. When omitted, the amendment applies system-wide (or only to componentRef when that is set)."
             }
@@ -2625,9 +2821,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0",
       "title": "HDF Result Primitives",
       "description": "Types for representing assessment results and statuses.",
       "$defs": {
@@ -2758,9 +2954,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0",
       "title": "HDF CVSS Primitives",
       "description": "Types for representing CVSS (Common Vulnerability Scoring System) data attached to assessment findings. Supports CVSS v2.0, v3.0, v3.1, and v4.0 metric groups (Base, Threat, Environmental, Supplemental).",
       "$defs": {
@@ -2962,9 +3158,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0",
       "title": "HDF Affected Package Primitives",
       "description": "Types for representing the software package(s) affected by a vulnerability finding.",
       "$defs": {
@@ -3077,9 +3273,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0",
       "title": "HDF Component Primitives",
       "description": "First-class system component with identity, polymorphic type, generalized BOM attachment (boms[]), and system-binding properties. Components are the successor to Targets, adding stable identity (componentId), external system cross-references, and manifest inventory (SBOM, AI model/dataset, and reserved future BOM kinds).",
       "$defs": {
@@ -3125,7 +3321,7 @@
               "description": "Description of this component's role or purpose."
             },
             "owner": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
               "description": "Team or individual responsible for this component. Enables per-component ownership when different teams manage different parts of a system."
             },
             "externalIds": {
@@ -3145,14 +3341,14 @@
             "boms": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.4.0#/$defs/Bom"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0#/$defs/Bom"
               },
               "description": "Component-scoped Bills of Materials (SBOM, ai-model, dataset, or any reserved bomType), each carried by passthrough (ref/document) or normalized. Replaces the former sbom/sbomRef/sbomFormat trio; a component may carry several BOMs (e.g. an SBOM plus an ai-model BOM). See primitives/bom.schema.json."
             },
             "integrity": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Checksum"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"
               },
               "description": "Cryptographic integrity of this component's underlying artifact — model weights or shards, dataset archive, container image, or package bytes. An array supports multi-file/sharded artifacts. This is the single, generic home for artifact/subject integrity across all component types (it replaced the former per-type Container_Image digest and Artifact checksum fields). Distinct from BOM-document integrity (Bom.hashes[]) and from the document tamper-evidence Integrity type."
             },
@@ -3166,12 +3362,12 @@
             "inputOverrides": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.4.0#/$defs/Input_Override"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Input_Override"
               },
               "description": "System-specific overrides for baseline input values."
             },
             "targetSelector": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.4.0#/$defs/Target_Selector",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Target_Selector",
               "description": "Label selector to match targets belonging to this component during migration. Targets with matching labels are automatically included."
             }
           },
@@ -3455,7 +3651,7 @@
                   "const": "cloudAccount"
                 },
                 "provider": {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Cloud_Provider",
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Cloud_Provider",
                   "description": "Cloud provider."
                 },
                 "accountId": {
@@ -3494,7 +3690,7 @@
                   "const": "cloudResource"
                 },
                 "provider": {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Cloud_Provider",
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Cloud_Provider",
                   "description": "Cloud provider."
                 },
                 "resourceType": {
@@ -3793,9 +3989,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0",
       "title": "HDF BOM Primitives",
       "description": "Generalized Bill-of-Materials / manifest representation. One extensible Bom shape, discriminated by bomType, carries any manifest kind (SBOM, AI model/dataset, and reserved future kinds) either by passthrough (opaque ref/embed of the native document) or normalized (converted into HDF's queryable shape). Subject identity (name, version, componentId) is inherited from the host component or system — the BOM never re-owns it. See ADR-0001.",
       "$defs": {
@@ -3851,7 +4047,7 @@
             "hashes": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Checksum"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"
               },
               "description": "Integrity of the carried BOM *document* itself (the referenced/embedded manifest file), NOT the integrity of the BOM's subject artifact. Subject/artifact integrity (model weights, dataset archive) is a component-level concern, not carried here. Subject identity is inherited from the host component/system; per-node identity lives in the type-extension."
             },
@@ -4266,9 +4462,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0",
       "title": "HDF System Primitives",
       "description": "Types for describing system architecture, authorization boundaries, and components.",
       "$defs": {
@@ -4319,7 +4515,7 @@
               "description": "Rationale for why this override is needed."
             },
             "approvedBy": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
               "description": "Identity of the person or system that approved this override."
             }
           },
@@ -4401,15 +4597,22 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0",
       "type": "object",
       "unevaluatedProperties": false,
       "required": [
         "baselines"
       ],
       "properties": {
+        "externalReferences": {
+          "type": "array",
+          "items": {
+            "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
+          },
+          "description": "Optional references to external artifacts (CTI/STIX, BOMs, advisories, runbooks, or any URI-addressable artifact) relevant to this assessment as a whole. Inert context; see External_Reference."
+        },
         "id": {
           "type": "string",
           "format": "uuid",
@@ -4423,7 +4626,7 @@
         "components": {
           "type": "array",
           "items": {
-            "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.4.0#/$defs/Component"
+            "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"
           },
           "description": "The components that were assessed. Each component describes a system element (host, container, cloud resource, application, etc.) with optional identity, SBOM, and external references."
         },
@@ -4435,27 +4638,27 @@
           "description": "Information on the baselines that were evaluated, including findings."
         },
         "statistics": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.4.0#/$defs/Statistics",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0#/$defs/Statistics",
           "description": "Statistics for the assessment run, including duration and result counts."
         },
         "generator": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0#/$defs/Generator",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Generator",
           "description": "Information about the tool that generated this file."
         },
         "tool": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0#/$defs/Tool",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Tool",
           "description": "The security tool that produced the assessment data in this file."
         },
         "integrity": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0#/$defs/Integrity",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity",
           "description": "Cryptographic integrity information for verifying this file."
         },
         "runner": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.4.0#/$defs/Runner",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0#/$defs/Runner",
           "description": "Information about the test execution environment where the security tool was run. Distinct from targets (what is being tested)."
         },
         "remediation": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Remediation",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Remediation",
           "description": "Optional reference to automated remediation resources (Ansible playbooks, Terraform scripts, etc.) for fixing failing requirements found in this assessment."
         },
         "systemRef": {
@@ -4468,6 +4671,10 @@
           "format": "uri-reference",
           "description": "Reference to an hdf-plan document describing the assessment plan that produced these results. May be a relative path, absolute URI, or fragment identifier."
         },
+        "derivation": {
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0#/$defs/Derivation",
+          "description": "Present ONLY on reconciled result sets: lineage recording the seed snapshot and event watermark this document was reassembled from (ADR-0005). Documents produced directly by a scan omit this field. When present, generator names the reconciling tool."
+        },
         "extensions": {
           "type": "object",
           "additionalProperties": true,
@@ -4563,14 +4770,14 @@
           ],
           "allOf": [
             {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Baseline_Metadata"
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Baseline_Metadata"
             }
           ],
           "properties": {
             "depends": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Dependency"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Dependency"
               },
               "description": "The set of dependencies this baseline depends on."
             },
@@ -4583,15 +4790,15 @@
               "description": "The description - should be more detailed than the summary."
             },
             "integrity": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0#/$defs/Integrity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity",
               "description": "Cryptographic integrity information for verifying this baseline has not been tampered with."
             },
             "originalChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
               "description": "SHA-256 checksum of the original baseline definition file (before execution). This is an immutable reference to the baseline as defined, used to detect tampering with baseline requirements or metadata."
             },
             "resultsChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
               "description": "SHA-256 checksum of the raw results before any amendments (statusOverrides or POAMs). Used to detect tampering with test results. Compare with currentChecksum to verify amendment integrity."
             },
             "statusMessage": {
@@ -4609,14 +4816,14 @@
             "groups": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Requirement_Group"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Requirement_Group"
               },
               "description": "A set of descriptions for the requirement groups."
             },
             "inputs": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.4.0#/$defs/Input"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0#/$defs/Input"
               },
               "description": "Typed inputs used to parameterize this baseline at execution time. See the Input primitive for the full schema."
             },
@@ -4641,7 +4848,7 @@
           ],
           "allOf": [
             {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Requirement_Core"
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Requirement_Core"
             }
           ],
           "properties": {
@@ -4649,7 +4856,7 @@
               "type": "array",
               "minItems": 1,
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.4.0#/$defs/Requirement_Description"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Requirement_Description"
               },
               "contains": {
                 "type": "object",
@@ -4665,37 +4872,37 @@
               "description": "Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."
             },
             "severity": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Severity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Severity",
               "description": "Explicit severity rating. Typically derived from impact score but provided explicitly for clarity."
             },
             "sourceLocation": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Source_Location",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Source_Location",
               "description": "The explicit location of the requirement within the source code."
             },
             "results": {
               "type": "array",
               "minItems": 1,
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.4.0#/$defs/Requirement_Result"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Requirement_Result"
               },
               "description": "The set of all tests within the requirement and their results."
             },
             "statusOverrides": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0#/$defs/Status_Override"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Status_Override"
               },
               "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."
             },
             "poams": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.4.0#/$defs/POAM"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/POAM"
               },
               "description": "Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change effectiveStatus - they track the work being done to address a failure. Separate from statusOverrides which DO change status."
             },
             "effectiveStatus": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.4.0#/$defs/Result_Status",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
               "description": "The current effective compliance status of this requirement after applying the most recent non-expired override with a status field, or computed from results (worst-wins) if no status-bearing overrides exist."
             },
             "effectiveImpact": {
@@ -4705,29 +4912,33 @@
               "description": "The current effective impact score (0.0–1.0) after applying the most recent non-expired override with an impact field. Absent when no impact overrides apply; consumers should use the requirement's impact field in that case."
             },
             "disposition": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.4.0#/$defs/Override_Type",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Override_Type",
               "description": "The type of the most recent non-expired override or POAM governing this requirement. Indicates why the requirement is in its current state (e.g., waiver, falsePositive, riskAdjustment) or what remediation is being tracked (poam). Absent when no overrides or POAMs apply."
             },
+            "effectiveChecksum": {
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
+              "description": "Checksum of this requirement's resolved effective posture, for per-control change detection in continuous monitoring. sha256 over the canonical JSON object with keys status, impact, disposition (in that order), holding the resolved effective status, resolved effective impact, and governing override type (null when nothing governs), with override expiry anchored to the document timestamp. Flips exactly when the operative status, impact, or disposition changes; stable under all other churn (result details, timestamps, tags). Optional; stamped by tooling (hdf convert, hdf amend apply)."
+            },
             "evidence": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Evidence"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
               },
               "description": "Supporting evidence for this requirement's findings, such as screenshots, code samples, or log excerpts."
             },
             "cvss": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.4.0#/$defs/Cvss"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss"
               },
               "description": "Structured CVSS scoring data for vulnerability findings. One entry per CVE — a finding may match multiple CVEs (common in vulnerability scanners). Captures vendor-supplied Base metrics plus optional consumer-owned Threat / Environmental / Supplemental groups for risk adjustment. See cvss.schema.json."
             },
             "epss": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.4.0#/$defs/Epss",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0#/$defs/Epss",
               "description": "FIRST.org EPSS (Exploit Prediction Scoring System) score for this CVE finding. Used alongside CVSS for prioritization — captures the probability the vulnerability will be exploited."
             },
             "kev": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.4.0#/$defs/Kev",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0#/$defs/Kev",
               "description": "CISA Known Exploited Vulnerabilities (KEV) catalog status. When inKev=true, dateAdded and dueDate carry the federal patching deadline."
             },
             "cwe": {
@@ -4741,7 +4952,7 @@
             "affectedPackages": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.4.0#/$defs/Affected_Package"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0#/$defs/Affected_Package"
               },
               "description": "Packages affected by this vulnerability finding. Vulnerability-finding-scoped — see components[] on hdf-system for component-level package inventories. One entry per matched package signature (scanners often report multiple CPE variations per CVE)."
             }
@@ -4806,11 +5017,15 @@
                     "identifier": "ao@agency.gov"
                   },
                   "appliedAt": "2026-01-20T10:00:00Z",
-                  "expiresAt": "2026-07-20T00:00:00Z"
+                  "expiresAt": "2099-12-31T00:00:00Z"
                 }
               ],
               "effectiveStatus": "passed",
-              "disposition": "waiver"
+              "disposition": "waiver",
+              "effectiveChecksum": {
+                "algorithm": "sha256",
+                "value": "d11c074ab9131807816013a71d986f1ceb2e5871a8a01dee4043391b7a6bf37b"
+              }
             },
             {
               "$comment": "False positive (compliance scan) — STIG check was wrong, requirement actually passes",
@@ -5008,6 +5223,7 @@
                     "identifier": "ops@agency.gov"
                   },
                   "appliedAt": "2026-01-20T10:00:00Z",
+                  "expiresAt": "2099-12-31T00:00:00Z",
                   "milestones": [
                     {
                       "description": "Vendor releases compatible patch",
@@ -5031,9 +5247,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0",
       "title": "HDF Statistics Primitives",
       "description": "Statistics types for tracking assessment run metrics.",
       "$defs": {
@@ -5102,9 +5318,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0",
       "title": "HDF Runner Primitive",
       "description": "Information about the test execution environment where the security tool/scanner was executed.",
       "$defs": {
@@ -5148,7 +5364,7 @@
               "description": "The container instance identifier. Example: 'a1b2c3d4e5f6', 'security-scan-job-xyz123'. Can be a Docker container ID, Kubernetes pod name, or other container runtime identifier."
             },
             "operator": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.4.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
               "description": "The identity of the person or system responsible for executing the test. This could be a human auditor manually completing a checklist, an automated CI/CD system, or a security tool. Optional field to support both automated and manual HDF generation."
             }
           },
@@ -5197,9 +5413,237 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0": {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0",
+      "title": "HDF Change Event Primitives",
+      "description": "Shared building blocks for HDF change-event wire documents. The envelope is entity-agnostic: hdf-requirement-change-event composes it today, and any future sibling event type (e.g. component change events — hdf-comparison already models componentDiffs alongside requirementDiffs) reuses it verbatim.",
+      "$defs": {
+        "Change_Event_Envelope": {
+          "type": "object",
+          "required": [
+            "eventId",
+            "source",
+            "sequence",
+            "systemRef",
+            "componentId",
+            "timestamp",
+            "priorChecksum"
+          ],
+          "properties": {
+            "eventId": {
+              "type": "string",
+              "format": "uuid",
+              "description": "Identity of this event occurrence, unique per source. (source, eventId) is the deduplication key: consumers may treat events with identical source and eventId as duplicates. UUIDv7 (time-ordered) is recommended but not required."
+            },
+            "source": {
+              "type": "string",
+              "format": "uri-reference",
+              "description": "URI identifying the producer context that emitted this event (for example, a scanner instance and profile). eventId uniqueness and sequence numbering are scoped per source."
+            },
+            "sequence": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Monotonically increasing sequence number per entity key. The ONLY ordering authority for folding: consumers keep the greatest sequence per key regardless of arrival order or timestamp. Deliberately per-entity-key (event-sourcing aggregate-version practice) rather than per-source."
+            },
+            "systemRef": {
+              "type": "string",
+              "format": "uri-reference",
+              "description": "URI to the hdf-system document (authorization boundary) this event applies to. Resolves to the latest version of the evolving system document."
+            },
+            "componentId": {
+              "type": "string",
+              "format": "uuid",
+              "description": "componentId of the system component this event concerns."
+            },
+            "timestamp": {
+              "type": "string",
+              "format": "date-time",
+              "description": "Occurrence time of the observed change (RFC 3339, trimmed UTC). Display and audit metadata only — NEVER an ordering key; ordering is sequence's job."
+            },
+            "schemaRef": {
+              "type": "string",
+              "format": "uri",
+              "description": "The versioned schema $id this event validates against, so events self-describe on heterogeneous streams. Recommended on every wire event."
+            },
+            "priorChecksum": {
+              "oneOf": [
+                {
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "The effectiveChecksum of the entity state this event supersedes, forming a per-key hash chain: a mismatch or gap against stored state is detectable, letting a consumer mark the key unverified instead of serving stale posture. Null at chain start (no prior state, e.g. a new entity or the first event after a seed). The chain provides tamper/gap evidence given a trusted head; completeness is anchored out-of-band by periodic re-centering rescans."
+            }
+          },
+          "examples": [
+            {
+              "$comment": "Steady-state envelope: mid-chain event from an InSpec producer. priorChecksum links to the previous effectiveChecksum for this key.",
+              "eventId": "0190f6f2-1c4e-7c3a-9f2a-3b1d5e7a9c01",
+              "source": "inspec://web01/rhel9-stig",
+              "sequence": 412,
+              "systemRef": "apptier.hdf-system.json",
+              "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
+              "timestamp": "2026-07-22T14:03:11Z",
+              "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0",
+              "priorChecksum": {
+                "algorithm": "sha256",
+                "value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
+              }
+            },
+            {
+              "$comment": "Chain-start envelope: first event for a key after seeding — priorChecksum is null (the CloudTrail null-previous-digest convention), sequence starts low.",
+              "eventId": "0190f6f2-2a5b-7e4d-b1c8-4f2e6a8b0d12",
+              "source": "inspec://web01/rhel9-stig",
+              "sequence": 1,
+              "systemRef": "apptier.hdf-system.json",
+              "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
+              "timestamp": "2026-07-22T09:00:00Z",
+              "priorChecksum": null
+            }
+          ],
+          "description": "Entity-agnostic transport identity for a change event: dedup ((source, eventId)), ordering (per-key sequence), system anchor (systemRef + componentId), occurrence time, schema self-description, and the prior-state hash-chain link. Composed into each concrete event type via allOf; entity-specific keys and payload live on the event type.",
+          "title": "Change Event Envelope"
+        },
+        "Event_Requirement_State": {
+          "type": "string",
+          "enum": [
+            "new",
+            "absent",
+            "updated",
+            "fixed",
+            "regressed"
+          ],
+          "description": "The producer-computable subset of the comparison vocabulary's Requirement_State. Kept value-identical with the parent enum (test-enforced): the batch-only states (moved, split, merged) are outputs of cross-document identity resolution a per-key producer cannot compute. Declared as a distinct named type (rather than a $ref intersection) so generated Go/TS types keep stable, distinct enum names.",
+          "title": "Event Requirement State"
+        },
+        "Event_Change_Reason": {
+          "type": "string",
+          "enum": [
+            "resultChanged",
+            "overrideAdded",
+            "overrideExpired",
+            "overrideRemoved",
+            "overrideModified",
+            "impactChanged",
+            "configChanged"
+          ],
+          "description": "The producer-computable subset of the comparison vocabulary's Change_Reason, value-identical with the parent enum (test-enforced). Batch-only reasons (baselineUpgraded, controlMapped, scannerChanged, targetChanged, metadataChanged) require cross-corpus context and are excluded.",
+          "title": "Event Change Reason"
+        },
+        "Effective_Projection": {
+          "type": "object",
+          "unevaluatedProperties": false,
+          "required": [
+            "effectiveStatus",
+            "effectiveImpact"
+          ],
+          "properties": {
+            "effectiveStatus": {
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
+              "description": "The resolved effective compliance status at this point in the chain."
+            },
+            "effectiveImpact": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 1,
+              "description": "The resolved effective impact score (0.0–1.0) at this point in the chain."
+            }
+          },
+          "examples": [
+            {
+              "$comment": "Prior posture of a failing SSH-cipher control before remediation.",
+              "effectiveStatus": "failed",
+              "effectiveImpact": 0.5
+            },
+            {
+              "$comment": "Prior posture of a control passing under a waiver (the projection carries the resolved status; the governing override type travels in the requirement payload, not here).",
+              "effectiveStatus": "passed",
+              "effectiveImpact": 0.5
+            }
+          ],
+          "description": "The minimal resolved-posture projection — the same field set the per-requirement effectiveChecksum hashes (status and impact; the governing disposition is carried by the full requirement payload).",
+          "title": "Effective Projection"
+        },
+        "Derivation": {
+          "type": "object",
+          "unevaluatedProperties": false,
+          "required": [
+            "seed",
+            "source",
+            "throughSequence",
+            "eventsApplied",
+            "asOf"
+          ],
+          "properties": {
+            "seed": {
+              "type": "object",
+              "unevaluatedProperties": false,
+              "required": [
+                "uri",
+                "checksum"
+              ],
+              "properties": {
+                "uri": {
+                  "type": "string",
+                  "format": "uri-reference",
+                  "description": "URI to the seed snapshot document (relative path or absolute URL)."
+                },
+                "checksum": {
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
+                  "description": "Checksum of the seed snapshot, REQUIRED: the derivation pins an immutable snapshot by content, not just location."
+                }
+              },
+              "$comment": "Location + expected-hash reference (the SRI/OCI/SPDX pattern). Shares its core shape with hdf-evidence-package's Content_Reference and ADR-0006's proposed External_Reference; consolidation onto one reference primitive is tracked by bead hdf-libs-avp2.",
+              "description": "The authoritative snapshot this document was reassembled from, pinned by content."
+            },
+            "source": {
+              "type": "string",
+              "format": "uri-reference",
+              "description": "URI of the event-stream producer context whose events were applied (matches the events' envelope source)."
+            },
+            "throughSequence": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "The event watermark: the highest per-key sequence number applied. Downstream precedence rule: a full-scan document supersedes the reconciled view as of its scan time; between scans, the reconciled document with the highest throughSequence is the current posture."
+            },
+            "eventsApplied": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Number of change events applied to the seed to produce this document."
+            },
+            "asOf": {
+              "type": "string",
+              "format": "date-time",
+              "description": "The posture-as-of time of this reconciled view (RFC 3339, trimmed UTC) — the analog of PROV's generatedAtTime."
+            }
+          },
+          "examples": [
+            {
+              "$comment": "A reconciled result set: reassembled from the pinned seed scan plus 3 change events through watermark 414. The document's generator names the reconciler, never the scanner.",
+              "seed": {
+                "uri": "apptier-seed-scan.hdf.json",
+                "checksum": {
+                  "algorithm": "sha256",
+                  "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                }
+              },
+              "source": "inspec://web01/rhel9-stig",
+              "throughSequence": 414,
+              "eventsApplied": 3,
+              "asOf": "2026-07-24T10:15:00Z"
+            }
+          ],
+          "description": "Derived-document lineage for a reconciled result set (an hdf-results produced by applyChangeEvents rather than a scanner). Records exactly which seed and event horizon the document represents so it can never masquerade as primary scan evidence. Conceptually PROV qualified derivation: derived entity, used entity (seed), activity (event application), generation time (asOf).",
+          "title": "Derivation"
+        }
+      }
+    },
+    "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0",
       "title": "HDF Parameter Primitives",
       "description": "Input/parameter type definitions for typed, traceable configuration values that bridge governance prose and scanner automation.",
       "$defs": {
@@ -5330,9 +5774,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0",
       "title": "HDF EPSS Primitive",
       "description": "Type for representing FIRST.org's Exploit Prediction Scoring System (EPSS) data for a vulnerability. EPSS estimates the probability that a CVE will be exploited in the wild in the next 30 days. See https://www.first.org/epss/ for the underlying model and methodology.",
       "$defs": {
@@ -5389,9 +5833,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.4.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.4.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0",
       "title": "HDF Kev Primitives",
       "description": "Types for representing CISA Known Exploited Vulnerabilities (KEV) catalog membership. The KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) flags CVEs that are confirmed actively exploited in the wild and drives federal patching urgency under CISA Binding Operational Directive 22-01.",
       "$defs": {